CVE-2022-43571

🗓️ 03 Nov 2022 22:56:44Reported by SplunkType

cve🔗 web.nvd.nist.gov📰️ 6 Media mentions👁 103 Views🌐 WEB

In Splunk Enterprise v8.2.9 and below, authenticated user can execute arbitrary code through dashboard PDF generation

Reporter	Title	Published	Views	Family All 17
ATTACKERKB	CVE-2022-43571	3 Nov 202223:15	–	attackerkb
Circl	CVE-2022-43571	3 Jan 202320:18	–	circl
CNNVD	Splunk 代码注入漏洞	2 Nov 202200:00	–	cnnvd
Cvelist	CVE-2022-43571 Remote Code Execution through dashboard PDF generation component in Splunk Enterprise	3 Nov 202222:56	–	cvelist
GithubExploit	Exploit for Code Injection in Splunk	27 Dec 202208:00	–	githubexploit
Metasploit	Authenticated RCE in Splunk (SimpleXML dashboard PDF generation)	21 Jan 202618:56	–	metasploit
NCSC	Vulnerabilities fixed in Splunk Enterprise	3 Nov 202200:00	–	ncsc
NVD	CVE-2022-43571	3 Nov 202223:15	–	nvd
OSV	CVE-2022-43571	3 Nov 202223:15	–	osv
Packet Storm	📄 Splunk Enterprise 8.2.9 / 9.0.2 Remote Code Execution	21 Jan 202600:00	–	packetstorm

NVD

Node

splunk splunkRange8.1.0–8.1.12enterprise

splunk splunkRange8.2.0–8.2.9enterprise

splunk splunkRange9.0.0–9.0.2enterprise

splunk splunk_cloud_platformRange<9.0.2209

[
  {
    "defaultStatus": "unaffected",
    "product": "Splunk Enterprise",
    "vendor": "Splunk",
    "versions": [
      {
        "lessThan": "8.1.12",
        "status": "affected",
        "version": "8.1",
        "versionType": "custom"
      },
      {
        "lessThan": "8.2.9",
        "status": "affected",
        "version": "8.2",
        "versionType": "custom"
      },
      {
        "lessThan": "9.0.2",
        "status": "affected",
        "version": "9.0",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
research	www.research.splunk.com/application/b06b41d7-9570-4985-8137-0784f582a1b3/
splunk	www.splunk.com/en_us/product-security/announcements/svd-2022-1111.html

Parameter	Position	Path	Description	CWE
eai:data	nested	en-US/splunkd/__raw/servicesNS/{username}/{app}/data/ui/views	Authenticated user can inject malicious content into dashboard configuration via dashboard creation endpoint.	CWE-94
serverURL	path	en-US/api/pdfgen/render	PDF export endpoint renders the dashboard including injected content, enabling RCE when exploited with a crafted dashboard template.	CWE-94
app	path	en-US/api/pdfgen/render	PDF export endpoint renders the dashboard including injected content, enabling RCE when exploited with a crafted dashboard template.	CWE-94
dashboard	path	en-US/api/pdfgen/render	PDF export endpoint renders the dashboard including injected content, enabling RCE when exploited with a crafted dashboard template.	CWE-94
width	path	en-US/api/pdfgen/render	PDF export endpoint renders the dashboard including injected content, enabling RCE when exploited with a crafted dashboard template.	CWE-94
height	path	en-US/api/pdfgen/render	PDF export endpoint renders the dashboard including injected content, enabling RCE when exploited with a crafted dashboard template.	CWE-94

21 Nov 2024 07:26Current

8.9High risk

Vulners AI Score8.9

CVSS 3.18.8

EPSS0.75912

SSVC

CWE-94