Remote code execution (RCE) in Splunk Enterprise through Insecure XML Parsing
Splunk · Splunk Enterprise
A flaw in Splunk Enterprise's handling of user-supplied XSLT (extensible stylesheet language transformations) fails to sanitise that input, affecting the product's XML processing functionality. An attacker who can upload a malicious XSLT file can achieve remote code execution on the Splunk Enterprise instance, requiring network access, low privileges, and user interaction, with high complexity to exploit.
In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet language transformations (XSLT) that users supply. This means that an attacker can upload malicious XSLT which can result in remote code execution on the Splunk Enterprise instance.
- Exploited
- Not confirmed
- Reports
- 0
- Tactics
- 0/15
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
Public exploit code (Metasploit) appeared 12 days after disclosure. No confirmed exploitation is recorded.
- Disclosedday 0
- Public exploit codeMetasploit+12 days
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
No techniques linkedNo ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
Detection
2 rules for this CVE · 0 general rules for its techniquesRules for this CVE
2Sigma ruleAn open, vendor-neutral detection rule for log data. Security teams convert Sigma rules into searches for their own SIEM. that reference CVE-2023-46214 directly.Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.