HTTP: Splunk Enterprise getJobAsset Arbitrary File Write

This signature detects attempts to exploit a known vulnerability against Splunk Enterprise. A successful attack can lead to arbitrary code execution.

Extended Description

In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet language transformations (XSLT) that users supply. This means that an attacker can upload malicious XSLT which can result in remote code execution on the Splunk Enterprise instance.

Affected Products

Splunk splunk

References

CVE: CVE-2023-46214

URL: https://advisory.splunk.com/advisories/SVD-2023-1104

Short Name

HTTP:CTS:SPLUNK-ENT-FILE-WRT

Severity

Major

Recommended

True

Recommended Action

Drop

HTTP: Splunk Enterprise getJobAsset Arbitrary File Write

Extended Description

Affected Products

References

Found a potential security threat?