CVE-2023-32712: 
Splunk Enterprise vulnerability analysis and mitigation

In Splunk Enterprise versions below 9.1.0.2, 9.0.5.1, and 8.2.11.2, an attacker can inject American National Standards Institute (ANSI) escape codes into Splunk log files that can potentially lead to code execution in vulnerable terminal applications. The vulnerability (CVE-2023-32712) was disclosed on June 1, 2023, affecting both Splunk Enterprise and Universal Forwarder installations (Vendor Advisory).

The vulnerability allows attackers to inject ANSI escape codes into Splunk log files. The attack requires a user to use a terminal application that supports ANSI escape code translation to read the malicious log file locally in the vulnerable terminal, and perform additional user interaction to exploit. The vulnerability has been assigned a CVSS v3.1 base score of 8.6 (High) with vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. The weakness is classified under CWE-117 (Improper Output Neutralization for Logs) and CWE-116 (Improper Encoding or Escaping of Output) (NVD).

The vulnerability does not directly affect Splunk Enterprise or Universal Forwarder, but the indirect impact can vary significantly depending on the permissions in the vulnerable terminal application and how users read the malicious log file. For example, users who copy the malicious file from the Splunk Enterprise instance and read it on their local machine could potentially experience code execution in their terminal application (Vendor Advisory).

For Splunk Enterprise, users should upgrade to version 8.2.11.2, 9.0.5.1, or 9.1.0.2. For Universal Forwarder, upgrade to version 8.2.12, 9.0.6, or 9.1.1. As partial mitigation, users can disable ANSI escape code processing in terminal applications or use terminals that support ANSI code filtering. For Universal Forwarder, configure management services to only accept localhost connections and consider using UDS for communication in versions 9.1.x and higher (Vendor Advisory).

The vulnerability was discovered and reported by security researcher STÖK / Fredrik Alexandersson (Vendor Advisory).