CVE-2024-45731

Relative Path Traversal (CWE-23)

Published: Oct 14, 2024 / Updated: 36d ago

Classification: Severe, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 8.8, CVEs: CVE-2024-45731, CVE-2024-45732, CVE-2024-45733, CVE-2024-45734, CVE-2024-45735, CVE-2024-45736, CVE-2024-45737, CVE-2024-45738, CVE-2024-45739, CVE-2024-45740, CVE-2024-45741, Summary: Remote Code Execution (RCE) due to insecure session storage configuration in Splunk Enterprise on Windows In Splunk Enterprise for Windows versions below 9.2.3 and 9.1.6, a low-privileged user that does not hold the “admin” or “power” Splunk roles could perform a Remote Code Execution (RCE) due to insecure session storage configuration. https://advisory.splunk.com/advisories/SVD-2024-1001 Potential Remote Command Execution (RCE) through arbitrary file write to Windows system root directory when Splunk Enterprise for Windows is installed on a separate disk https://advisory.splunk.com/advisories/SVD-2024-1002 Low-privileged user could run search as nobody in SplunkDeploymentServerConfig app Lower severity advisories: SVD-2024-1004 Low Privilege User can View Images on the Host Machine by using the PDF Export feature in Splunk Classic Dashboard Medium CVE-2024-45734 SVD-2024-1005 Improper Access Control for low-privileged user in Splunk Secure Gateway App Medium CVE-2024-45735 SVD-2024-1006 Improperly Formatted ‘INGEST_EVAL’ Parameter Crashes Splunk Daemon Medium CVE-2024-45736 SVD-2024-1007 Maintenance mode state change of App Key Value Store (KVStore) through Cross-Site Request Forgery (CSRF) Medium CVE-2024-45737 SVD-2024-1008 Sensitive information disclosure in REST_Calls logging channel Medium CVE-2024-45738 SVD-2024-1009 Sensitive information disclosure in AdminManager logging channelMedium CVE-2024-45739 SVD-2024-1010 Persistent Cross-Site Scripting (XSS) through Scheduled Views on Splunk Enterprise Medium CVE-2024-45740 SVD-2024-1011 Persistent Cross-Site Scripting (XSS) via props.conf on Splunk Enterprise Medium CVE-2024-45741

The vulnerability CVE-2024-45731, with a CVSS score of 8.0, could allow a low-privileged user that does not hold the “admin” or “power” Splunk roles to write a file to the Windows system root directory, which has a default location in the Windows folder, when Splunk Enterprise for Windows is installed on a separate drive. The vulnerability CVE-2024-45733, with a CVSS score of 8.8, could allow a low-privileged user that does not hold the “admin” or “power” Splunk roles to perform a Remote Code Execution (RCE) due to an insecure session storage configuration.

The vulnerability CVE-2024-45731, with a CVSS score of 8.0, could allow a low-privileged user that does not hold the “admin” or “power” Splunk roles to write a file to the Windows system root directory, which has a default location in the Windows folder, when Splunk Enterprise for Windows is installed on a separate drive. The vulnerability CVE-2024-45733, with a CVSS score of 8.8, could allow a low-privileged user that does not hold the “admin” or “power” Splunk roles to perform a Remote Code Execution (RCE) due to an insecure session storage configuration.

A low-privileged attacker can exploit this vulnerability by writing a file to the Windows system root directory if Splunk is installed on a separate drive, potentially allowing the attacker to load a malicious DLL and execute code remotely. The remaining vulnerabilities fall into the medium and low categories, reflecting a range of potential threats that organizations using Splunk need to address urgently.

A low-privileged attacker can exploit this vulnerability by writing a file to the Windows system root directory if Splunk is installed on a separate drive, potentially allowing the attacker to load a malicious DLL and execute code remotely. The advisory categorizes these Splunk vulnerabilities into three main classifications based on their Common Vulnerability Scoring System (CVSS) base scores, highlighting two critical high-risk issues, eight medium-risk vulnerabilities, and one low-risk vulnerability.

Importantly, Splunk has confirmed that patches are available for all identified vulnerabilities, urging users to implement them promptly to mitigate potential risks. CVE-2024-45731 addresses a critical remote code execution vulnerability, receiving a CVSS score of 8.0, classified as high.

CVE-2024-45731 addresses a critical remote code execution vulnerability, receiving a CVSS score of 8.0, classified as high. Importantly, Splunk has confirmed that patches are available for all identified vulnerabilities, urging users to implement them promptly to mitigate potential risks.

From drones probing military bases to critical vulnerabilities in widely used software and hackers exploiting outdated physical access controls, organizations and governments face a wide range of risks that demand immediate attention and action. As reported by researchers at Trend Micro, the group is deploying a backdoor that uses Microsoft Exchange servers to steal credentials and which exploits a known Windows flaw to elevate their privileges on compromised devices.