Potential Remote Command Execution (RCE) through arbitrary file write to Windows system root directory when Splunk Enterprise for Windows is installed on a separate disk
Advisory ID: SVD-2024-1001
CVE ID: CVE-2024-45731
Published: 2024-10-14
Last Update: 2024-10-14
CVSSv3.1 Score: 8.0, High
CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
CWE: CWE-23
Bug ID: VULN-16991
Description
In Splunk Enterprise for Windows versions below 9.3.1, 9.2.3, and 9.1.6, a low-privileged user that does not hold the “admin” or “power” Splunk roles could write a file to the Windows system root directory, which has a default location in the Windows System32 folder, when Splunk Enterprise for Windows is installed on a separate drive. The user could potentially write a malicious DLL which, if loaded, could result in a remote execution of the code within that DLL.
Solution
Upgrade Splunk Enterprise to versions 9.3.1, 9.2.3, and 9.1.6, or higher.
Product Status
| Product | Version | Component | Affected Version | Fix Version |
|---|---|---|---|---|
| Splunk Enterprise | 9.3 | Splunk Web | 9.3.0 | 9.3.1 |
| Splunk Enterprise | 9.2 | Splunk Web | 9.2.0 to 9.2.2 | 9.2.3 |
| Splunk Enterprise | 9.1 | Splunk Web | 9.1.0 to 9.1.5 | 9.1.6 |
Mitigations and Workarounds
See Installation on Windows for more information on how to install Splunk Enterprise.
Detections
Severity
Splunk rates this vulnerability as 8.0, High, with a CVSSv3.1 vector of CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H.
If the Splunk Enterprise instance is not installed on a separate disk, there is no impact and the severity would be informational.
Acknowledgments
Alex Hordijk (hordalex)