CVE-2022-43563: 
Splunk Forwarder vulnerability analysis and mitigation

In Splunk Enterprise versions below 8.2.9 and 8.1.12, a vulnerability was discovered in the way the 'rex' search command handles field names, allowing attackers to bypass SPL safeguards for risky commands. The vulnerability was assigned CVE-2022-43563 and was disclosed on November 2, 2022. The issue affects Splunk Enterprise versions 8.1.x (before 8.1.12), 8.2.x (before 8.2.9), and Splunk Cloud Platform versions up to 9.0.2202 (Splunk Advisory).

The vulnerability received a CVSS v3.1 base score of 8.1 (High) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N. The flaw is classified as CWE-20 (Improper Input Validation). The vulnerability specifically relates to how the 'rex' search command processes field names, which can be exploited to circumvent built-in safeguards designed to prevent the execution of risky commands (NVD, Splunk Advisory).

If successfully exploited, the vulnerability allows attackers to execute risky commands with the permissions of a user who holds the "power" Splunk role. This could potentially lead to unauthorized access and system compromise with high confidentiality and integrity impact, though availability is not affected (Splunk Advisory).

The primary mitigation is to upgrade to Splunk Enterprise versions 8.1.12, 8.2.9, or higher. For Splunk Cloud Platform, Splunk actively patches and monitors the cloud instances. As a workaround, organizations can disable Splunk Web, as the vulnerability only affects instances with Splunk Web enabled (Splunk Advisory).