CVE-2023-46214

🗓️ 16 Nov 2023 20:15:25Reported by SplunkType

cve🔗 web.nvd.nist.gov📰️ 3 Media mentions👁 234 Views🌐 WEB

Insecure XSLT handling in Splunk Enterpris

Reporter	Title	Published	Views	Family All 16
0day.today	Splunk XSLT Upload Remote Code Execution Exploit	12 Dec 202300:00	–	zdt
Circl	CVE-2023-46214	19 Nov 202307:37	–	circl
CNNVD	Splunk Security Breach	16 Nov 202300:00	–	cnnvd
Cvelist	CVE-2023-46214 Remote code execution (RCE) in Splunk Enterprise through Insecure XML Parsing	16 Nov 202320:15	–	cvelist
GithubExploit	Exploit for XML Injection (aka Blind XPath Injection) in Splunk Cloud	18 Nov 202322:20	–	githubexploit
Metasploit	Splunk Authenticated XSLT Upload RCE	12 Dec 202319:52	–	metasploit
NCSC	Vulnerability fixed in Splunk	23 Nov 202300:00	–	ncsc
NVD	CVE-2023-46214	16 Nov 202321:15	–	nvd
OSV	CVE-2023-46214	16 Nov 202321:15	–	osv
Packet Storm	Splunk XSLT Upload Remote Code Execution	12 Dec 202300:00	–	packetstorm

NVD

Node

splunk cloudRange<9.1.2308

splunk splunkRange9.0.0–9.0.7enterprise

splunk splunkRange9.1.0–9.1.2enterprise

[
  {
    "product": "Splunk Enterprise",
    "vendor": "Splunk",
    "versions": [
      {
        "version": "9.0",
        "status": "affected",
        "versionType": "custom",
        "lessThan": "9.0.7"
      },
      {
        "version": "9.1",
        "status": "affected",
        "versionType": "custom",
        "lessThan": "9.1.2"
      }
    ]
  },
  {
    "product": "Splunk Cloud",
    "vendor": "Splunk",
    "versions": [
      {
        "version": "-",
        "status": "affected",
        "versionType": "custom",
        "lessThan": "9.1.2308"
      }
    ]
  }
]

Source	Link
research	www.research.splunk.com/application/6cb7e011-55fb-48e3-a98d-164fa854e37e/
advisory	www.advisory.splunk.com/advisories/SVD-2023-1104
research	www.research.splunk.com/application/a053e6a6-2146-483a-9798-2d43652f3299/

Parameter	Position	Path	Description	CWE
xsl	query param	en-US/api/search/jobs/{jsid}/results	XSLT transformation trigger endpoint where the attacker supplies an XSLT via the xsl parameter to cause remote code execution.	CWE-91
search	request body	en-US/splunkd/__raw/servicesNS/{USERNAME}/search/search/jobs	Endpoint used to create a search job; attacker can inject a payload via the search parameter to initiate payload execution.	CWE-91
spl-file	binary	en-US/splunkd/__upload/indexing/preview	Multipart upload endpoint used to upload the malicious XSLT file referenced by the exploit.	CWE-91

28 Feb 2025 11:03Current

8.5High risk

Vulners AI Score8.5

CVSS 3.18 - 8.8

EPSS0.87861

SSVC

CWE-91