Splunk Enterprise 9.4.0 < 9.4.15, 10.0.0 < 10.0.10, 10.2.0 < 10.2.6, 10.4.0 < 10.4.2 (SVD-2026-1001)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(364459);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/09");

  script_cve_id("CVE-2026-76264");
  script_xref(name:"IAVA", value:"2026-A-1105");

  script_name(english:"Splunk Enterprise 9.4.0 < 9.4.15, 10.0.0 < 10.0.10, 10.2.0 < 10.2.6, 10.4.0 < 10.4.2 (SVD-2026-1001)");

  script_set_attribute(attribute:"synopsis", value:
"An application running on a remote web server host is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of Splunk Enterprise installed on the remote host is 9.4.x prior to 9.4.15, 10.0.x prior to 10.0.10, 10.2.x
prior to 10.2.6, or 10.4.x prior to 10.4.2. It is, therefore, affected by an improper authorization vulnerability as
referenced in the SVD-2026-1001 advisory. A user who does not hold the admin or power roles could create or edit
scripted lookup definitions through raw configuration endpoints, because raw transforms configuration write paths do
not apply external lookup capability checks before saving scripted lookup settings. (CVE-2026-76264)

Note that this plugin only runs when 'Report paranoia' is set to 'Paranoid', because the fix also requires a
configuration change that Nessus cannot check.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://advisory.splunk.com/advisories/SVD-2026-1001.html");
  script_set_attribute(attribute:"solution", value:
"Upgrade Splunk Enterprise to version 9.4.15, 10.0.10, 10.2.6, 10.4.2, or later, then set
scripted_lookup_raw_write_enforcement = block under the [lookup] stanza of limits.conf and restart Splunk Enterprise.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:N/I:P/A:N");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-76264");
  script_cwe_id(863);

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/10/07");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/10/07");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/09");

  script_set_attribute(attribute:"potential_vulnerability", value:"true");
  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:splunk:splunk");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CGI abuses");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("splunkd_detect.nasl", "splunk_web_detect.nasl", "macos_splunk_installed.nbin", "splunk_win_installed.nbin", "splunk_nix_installed.nbin");
  script_require_keys("installed_sw/Splunk", "Settings/ParanoidReport");

  exit(0);
}

include('vcf.inc');
include('vcf_extras_splunk.inc');

# The fix also requires a limits.conf setting that is not collected.
if (report_paranoia < 2) audit(AUDIT_PARANOID);

var app_info = vcf::splunk::get_app_info();

var fix_note = ' with scripted_lookup_raw_write_enforcement = block';

var constraints = [
  { 'min_version' : '9.4.0', 'fixed_version' : '9.4.15', 'fixed_display' : '9.4.15' + fix_note, 'license' : 'Enterprise' },
  { 'min_version' : '10.0.0', 'fixed_version' : '10.0.10', 'fixed_display' : '10.0.10' + fix_note, 'license' : 'Enterprise' },
  { 'min_version' : '10.2.0', 'fixed_version' : '10.2.6', 'fixed_display' : '10.2.6' + fix_note, 'license' : 'Enterprise' },
  { 'min_version' : '10.4.0', 'fixed_version' : '10.4.2', 'fixed_display' : '10.4.2' + fix_note, 'license' : 'Enterprise' }
];

vcf::splunk::check_version_and_report(
    app_info:app_info,
    constraints:constraints,
    severity:SECURITY_WARNING
);