CVE-2023-40598

Description

In Splunk Enterprise versions below 8.2.12, 9.0.6, and 9.1.1, an attacker can create an external lookup that calls a legacy internal function. The attacker can use this internal function to insert code into the Splunk platform installation directory. From there, a user can execute arbitrary code on the Splunk platform Instance.

Reserved 2023-08-16 | Published 2023-08-30 | Updated 2025-01-15 | Assigner Splunk

Problem types

The software constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Product status

8.2 before 8.2.12
affected

9.0 before 9.0.6
affected

9.1 before 9.1.1
affected

- before 9.0.2305.200
affected

Credits

Danylo Dmytriiev (DDV_UA)

References

advisory.splunk.com/advisories/SVD-2023-0807

research.splunk.com/...ee69374a-d27e-4136-adac-956a96ff60fd/

cve.org (CVE-2023-40598)

nvd.nist.gov (CVE-2023-40598)

Download JSON