CVE-2024-36983: 
Splunk Enterprise vulnerability analysis and mitigation

A critical vulnerability (CVE-2024-36983) was discovered in Splunk Enterprise and Splunk Cloud Platform. The vulnerability affects Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10, and Splunk Cloud Platform versions below 9.1.2312.109 and 9.1.2308.207. The issue allows an authenticated user to create an external lookup that calls a legacy internal function, which can be exploited to insert and execute arbitrary code on the Splunk platform instance (Splunk Advisory).

The vulnerability revolves around the currently-deprecated 'runshellscript' command used by scripted alert actions. When combined with external command lookups, this allows an authenticated user to inject and execute commands within a privileged context from the Splunk platform instance. The vulnerability has been assigned a CVSSv3.1 base score of 8.8 (High) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H by NVD, while Splunk assigned it a score of 8.0 (High) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H. The vulnerability is classified as CWE-77 (Improper Neutralization of Special Elements used in a Command) (NVD, Splunk Advisory).

The vulnerability allows authenticated users to execute arbitrary code on the Splunk platform instance. This could potentially lead to complete system compromise, as attackers could insert and execute malicious code within the Splunk platform installation directory (Splunk Advisory, Cyber Security News).

The vulnerability requires authentication to exploit. An attacker needs to have access to create external lookups in the Splunk platform. The exploitation involves using a legacy internal function through external lookups to inject code into the Splunk platform installation directory (Splunk Advisory).

Users are strongly advised to upgrade to the patched versions: Splunk Enterprise 9.0.10 or later, 9.1.5 or later, or 9.2.2 or later. For Splunk Cloud Platform, the company is performing upgrades on instances as part of Emergency Maintenance for customers, as described in the Splunk Cloud Platform Maintenance Policy. Splunk is actively monitoring for potential issues that could arise from this vulnerability (Splunk Advisory).