SonicWall warns that a recently patched Splunk Enterprise vulnerability is more severe than initially considered and can be exploited with a simple GET request.
The issue, tracked as CVE-2024-36991 (CVSS score of 7.5), is described as a path traversal bug impacting Splunk Enterprise on Windows versions prior to 9.2.2, 9.1.5, and 9.0.10. Splunk announced patches for the flaw on July 1.
An attacker could exploit the vulnerability to perform a path traversal on the /modules/messaging/ endpoint, if Splunk Web is enabled on a vulnerable instance.
“The vulnerability exists because the Python os.path.join function removes the drive letter from path tokens if the drive in the token matches the drive in the built path,” Splunk explained its advisory.
According to SonicWall, an attacker could exploit CVE-2024-36991 to perform a directory listing on the endpoint, potentially gaining access to sensitive files on the system.
“A crafted GET request to a vulnerable Splunk instance with Splunk Web enabled is necessary and sufficient to exploit the issue. An attacker only needs to be able to access the instance remotely, which could be over the Internet or a local network,” SonicWall explains.
The company also warns that proof-of-concept (PoC) code targeting the security defect has been released on GitHub, increasing the risk of exploitation.
Furthermore, SonicWall notes that there are over 220,000 internet-exposed servers running Splunk, although it is unclear how many of these are vulnerable.
Users are advised to update their Splunk Enterprise on Windows installations as soon as possible, or to disable Splunk Web to mitigate the vulnerability.
“Considering the severe consequences of this vulnerability and the trend of nefarious actors trying to leverage the exploit in the wild, users are strongly encouraged to upgrade their instances in accordance with the Splunk advisory to address the vulnerability,” SonicWall says.
Related: Splunk Patches High-Severity Vulnerabilities in Enterprise Product
Related: Critical Vulnerabilities in Judge0 Lead to Sandbox Escape, Host Takeover
Related: Splunk Patches Vulnerabilities in Enterprise Product
Related: BIND Updates Patch Two High-Severity DoS Vulnerabilities
