QID 379543

Splunk software helps capture, index and correlate real-time data in a searchable repository, from which it can generate graphs, reports, alerts, dashboards and visualizations.
The Dashboard Examples Hub in the Splunk Dashboard Studio app lacks protections for risky SPL commands.

Affected Versions:
Splunk Enterprise versions from 9.0.0 to 9.0.8
Splunk Enterprise versions from 9.1.0 to 9.1.3
Splunk Enterprise versions from 9.2.0 to 9.2.0.1

QID Detection Logic (Authenticated)
Linux: Checks for installed vulnerable version of Splunk Enterprise from "/etc/splunk.version" file either in "/opt/splunk" directory or using "$SPLUNK_HOME" environment variable along with splunk web configuration check using "/etc/system/default/limit.conf" or "/etc/system/local/limit.conf".
Windows: Checks for installed vulnerable version of Splunk from "/etc/splunk.version" file using registry "HKLM\SYSTEM\CurrentControlSet\Services\Splunkd".

Note:
1. This QID doesn't check for the available workaround, hence marked potential.
2. The Dashboard Studio in Splunk Enterprise is affected. Vendor has provided fixed version of Splunk Enterprise.

Successful exploitation of this vulnerability allows attacker to bypass SPL safeguards for risky commands with the permissions of a highly-privileged user in the Hub.