Application Details
Splunk Enterprise is a data analytics and monitoring platform that allows any organization to collect, index, and analyze data from various sources, such as apps, servers, network devices and security systems.
Vulnerability
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10, an attacker could perform a path traversal on the /modules/messaging/ endpoint in Splunk Enterprise on Windows. The vulnerability exists because the Python os.path.join function removes the drive letter from path tokens if the drive in the token matches the drive in the built path.
Identification
An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to read arbitrary files on the system,, such as the Splunk’s /etc/passwd file.
GET /en-US/modules/messaging/C:../C:../C:../C:../C:../etc/passwd Detection
By turning this into a traffic file and matching rule, we are able to detect directory traversal attempts by an unauthenticated remote attacker.
Coverage
Idappcom have created signature 8025127 along with a traffic file for this vulnerability.
References
Traffic IQ
If you are concerned that your business may be at risk of this vulnerability or others why not try out our Traffic IQ software which can scan your defences and report any issues. Learn more here: https://www.idappcom.co.uk/traffic-iq-professional
Comments