Splunk-RCE-poc

Splunk RCE - PoC CVE-2023-46214, SVD-2023-1104에 대한 개념 증명PoC 익스플로잇 사용법 Splunk 인스턴스 URL, 사용자 이름, 비밀번호, 리버스 셸 IP 및 포트는 모두 명령줄 매개변수로 필요합니다. 예: $ python3 CVE-2023-46214.py --url --username --password --ip --port 사전 요구 사항 adddatamethods에 업로드 권한이 있는 Splunk 자격 증명 참고: 다른 벡터가 가능할 수도 있지만, 이것은 제가 사용한 방법일 뿐입니...

Splunk XSLT Upload Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Splunk Authenticated XSLT Upload RCE', 'Description' = %q This Metasploit module exploits a Remote Code Execution RCE vulnerability in Splunk...

CVE-2023-46214

creationtimestamp| type| source ---|---|--- 2023-11-19 07:37:50+00:00| published-proof-of-concept| https://t.me/proxybar/1832 2023-11-19 12:58:41+00:00| published-proof-of-concept| https://t.me/RalfHackerChannel/1418 2023-11-19 14:57:34+00:00| published-proof-of-concept| https://t.me/apsecurity/2...

Exploit for XML Injection (aka Blind XPath Injection) in Splunk Cloud

Splunk RCE - PoC Proof of concept exploit for CVE-2023-46214...

CVE-2023-46214 Remote code execution (RCE) in Splunk Enterprise through Insecure XML Parsing

In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet language transformations XSLT that users supply. This means that an attacker can upload malicious XSLT which can result in remote code execution on the Splunk Enterprise instance...

CVE-2023-46214

CVE-2023-46214 describes a remote code execution risk in Splunk Enterprise caused by unsafe sanitization of user-supplied XSLT. Affected versions are Splunk Enterprise 9.0.x before 9.0.7 and 9.1.x before 9.1.2, where uploading crafted XSLT can lead to code execution on the target. The vulnerabili...

CVE-2023-46214 Remote code execution (RCE) in Splunk Enterprise through Insecure XML Parsing

In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet language transformations XSLT that users supply. This means that an attacker can upload malicious XSLT which can result in remote code execution on the Splunk Enterprise instance...