HTTP: Splunk Enterprise Splunk App for Lookup File Editing Directory Traversal

This signature detects attempts to exploit a known vulnerability against Splunk Enterprise Splunk App for Lookup File. A successful attack can lead to directory traversal and arbitrary code execution.

Extended Description

In Splunk Enterprise on Windows versions below 9.2.2, 9.1.5, and 9.0.10, an attacker could perform a path traversal on the /modules/messaging/ endpoint in Splunk Enterprise on Windows. This vulnerability should only affect Splunk Enterprise on Windows.

References

CVE: CVE-2024-36991

URL: https://advisory.splunk.com/advisories/SVD-2024-0711

Short Name

HTTP:DIR:SPLUNK-ENT-LOOKUP

Severity

Major

Recommended

True

Recommended Action

Drop

HTTP: Splunk Enterprise Splunk App for Lookup File Editing Directory Traversal

Extended Description

References

Found a potential security threat?