jhurtadomi/cve-2024-36991-splunkPath traversal exploit for Splunk Enterprise on Windows (CVE-2024-36991) — interactive file harvester
| Field | Detail |
|---|
| CVE | CVE-2024-36991 |
| Type | CWE-22 — Path Traversal |
| Severity | HIGH |
| CVSS Score | 7.5 |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| Published | 2024-07-01 |
| Last modified | 2024-10-15 |
In Splunk Enterprise on Windows versions below 9.2.2, 9.1.5, and 9.0.10, an attacker could perform a path traversal on the /modules/messaging/ endpoint. No authentication required. This vulnerability only affects Splunk Enterprise on Windows.
| CPE | From | Until |
|---|---|---|
splunk:splunk:*:*:*:*:enterprise | 9.0.0 (inclusive) | 9.0.10 (exclusive) |
splunk:splunk:*:*:*:*:enterprise | 9.1.0 (inclusive) | 9.1.5 (exclusive) |
splunk:splunk:*:*:*:*:enterprise | 9.2.0 (inclusive) | 9.2.2 (exclusive) |
# Interactive — picker appears on launch
python3 CVE-2024-36991.py
# Pass target directly
python3 CVE-2024-36991.py -u http://<target>:<port>
| Key | Group |
|---|---|
c | Harvest Creds |
f | Conf Exposure |
l | Logs & History |
s | System FootPrinting |
a | Apps Surface |
* | All groups |
q | Quit |
| Group | Files |
|---|---|
| Harvest Creds | passwd, splunk.secret, server.pem, authentication.conf, passwords.conf |
| Conf Exposure | server.conf, web.conf, inputs.conf, user-seed.conf |
| Logs & History | splunkd.log, audit.log, metrics.log, searches.log, session |
| System FootPrinting | win.ini, hosts, persistentstorage.db |
| Apps Surface | Splunk_TA_windows, Splunk_TA_nix, SplunkForwarder, Splunk_SA_CIM |
requests comes pre-installed on Kali Linux, but it doesn't hurt to include it
pip install requests
This tool is intended for educational purposes and authorized penetration testing only. Do not use against systems you do not have explicit permission to test.
poc by iamwin