CVE-2023-22935 : What You Need to Know

This CVE-2023-22935, assigned by Splunk, was published on February 14, 2023. The vulnerability affects Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, as well as instances with Splunk Web enabled.

Understanding CVE-2023-22935

This vulnerability allows a search parameter, specifically the

display.page.search.patterns.sensitivity

, to bypass certain SPL safeguards for risky commands in Splunk Enterprise.

What is CVE-2023-22935?

The CVE-2023-22935 vulnerability in Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4 enables a higher privileged user to initiate a request within their browser, bypassing SPL safeguards for risky commands. It specifically impacts instances with Splunk Web enabled.

The Impact of CVE-2023-22935

With a CVSSv3.1 base score of 8.1 (HIGH), this vulnerability poses a significant risk by allowing unauthorized bypass of security controls within affected Splunk Enterprise versions.

Technical Details of CVE-2023-22935

This section provides a detailed insight into the vulnerability, its affected systems, and how it can be exploited.

Vulnerability Description

The

display.page.search.patterns.sensitivity

search parameter in Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4 permits a search to circumvent SPL safeguards for risky commands.

Affected Systems and Versions

Splunk Enterprise versions below 8.1.13
Splunk Enterprise versions below 8.2.10
Splunk Enterprise versions below 9.0.4

Exploitation Mechanism

The vulnerability requires a higher privileged user to initiate a request via their browser in instances with Splunk Web enabled.

Mitigation and Prevention

To safeguard against CVE-2023-22935, immediate steps and long-term security practices need to be implemented.

Immediate Steps to Take

Upgrade affected Splunk Enterprise instances to versions 8.1.13, 8.2.10, or 9.0.4 to mitigate the vulnerability.
Restrict access permissions to reduce the risk of unauthorized users bypassing security controls.

Long-Term Security Practices

Regularly audit and monitor Splunk Enterprise instances for any suspicious activity or unauthorized access attempts.
Conduct security training for users to enhance awareness of safe practices while utilizing Splunk Web.

Patching and Updates

Stay informed about security advisories from Splunk to promptly apply patches and updates that address security vulnerabilities like CVE-2023-22935.