Splunk Remote Command Execution Vulnerability via the REST API

A remote command execution vulnerability has been identified in Splunk Enterprise and Splunk Cloud Platform. In Splunk Enterprise versions prior to 10.2.0, 10.0.4, 9.4.9, and 9.3.10, as well as in Splunk Cloud Platform versions prior to 10.2.2510.5, 10.0.2503.12, 10.1.2507.16, and 9.3.2411.124, users with the high-privilege capability 'edit_cmd' can execute arbitrary shell commands. This is achieved by using the 'unarchive_cmd' parameter on the '/splunkd/__upload/indexing/preview' REST endpoint'. The vulnerability arises from inadequate input sanitization when previewing uploaded files before they are indexed.

Impact

Exploitation of this vulnerability allows for arbitrary shell command execution on the server where Splunk is running.

Remediation

Users can upgrade to Splunk Enterprise versions 10.2.0, 10.0.4, 9.4.9, 9.3.10 or to the respective fixed versions in Splunk Cloud Platform. If an immediate upgrade is not possible, the high-privilege capability 'edit_cmd' can be removed from the user's role.