Splunk Path Traversal Exploit (CVE-2024-36991)

Description

This is a Proof-of-Concept (PoC) exploit script for CVE-2024-36991, a path traversal vulnerability affecting Splunk Enterprise on Windows versions below:

• 9.2.2
• 9.1.5
• 9.0.10

The vulnerability allows unauthenticated attackers to access sensitive files on the server by exploiting a path traversal flaw in the Splunk web interface.

Severity: Critical
Impact: Arbitrary File Read

⚠️ Vulnerable Versions

• Splunk Enterprise < 9.2.2
• Splunk Enterprise < 9.1.5
• Splunk Enterprise < 9.0.10

💡 Usage

To run the exploit, use the following commands:

# Using Python3
python3 exploit.py -u http://victim.com -s 1

# Running directly
./exploit.py -u http://victim.com -s 1

Parameters:

• -u, --url: The base URL of the target Splunk server.
• -s, --section: Select the section to enumerate (1-5):

Sections:

1. Credentials & Secrets:

   • /etc/passwd
   • /etc/auth/splunk.secret
   • /etc/auth/server.pem
   • /var/run/splunk/session
   • /etc/system/local/authentication.conf

2. Configuration Files:

   • /etc/system/local/web.conf
   • /etc/system/local/inputs.conf

3. Logs & History:

   • /var/log/splunk/splunkd.log
   • /var/log/splunk/audit.log
   • /var/log/splunk/metrics.log
   • /var/log/splunk/searches.log
   • /var/run/splunk/dispatch

🛡️ Mitigation

To protect your Splunk server:

• Upgrade to Splunk Enterprise 9.2.2, 9.1.5, or 9.0.10 or later.
• Apply proper access controls and firewall rules.

⚠️ Disclaimer

This exploit is for educational and authorized penetration testing purposes only. Unauthorized use is illegal and unethical. The author takes no responsibility for misuse.