Splunk fixed a critical flaw in Splunk Enterprise deployment servers, tracked as CVE-2022-32158. A compromised Universal Forwarder could use it to run code on other forwarders that connect to the same deployment server. Splunk rates it CVSS 9.0. Upgrade to 8.1.10.1, 8.2.6.1 or 9.0 and later.
What did Splunk fix?
Splunk has released security updates that address multiple vulnerabilities in Splunk Enterprise, including a critical vulnerability that could lead to arbitrary code execution. Splunk is a SIEM (Security Information and Event Management) solution that collects logs from various sources, stores (indexes) the collected logs, and provides search, research, analysis, and correlation on the stored logs.
How does CVE-2022-32158 work?
The security vulnerability tracked as CVE-2022-32158 occurs because Splunk Enterprise deployment servers allow clients to manipulate the server to distribute the message packets to other clients. A threat actor who compromises a Universal Forwarder endpoint could exploit this vulnerability to execute arbitrary code on all other Universal Forwarder endpoints that subscribe to the deployment server. The Splunk Universal Forwarder is used to collect data from endpoint systems. When the data we want to collect is not directly available on the server where Splunk is installed, the Splunk Universal Forwarder (UF) can be installed on your remote endpoint servers and used to forward the data back to Splunk for indexing.
Which other vulnerability did Splunk fix?
Splunk also announced a fix for a second vulnerability in Splunk Enterprise: deployment servers in versions prior to 9.0 allowed forwarder packets to be downloaded without authentication (CVE-2022-32157).
Which Splunk versions should you upgrade to?
Splunk Enterprise versions 8.1.10.1, 8.2.6.1 and 9.0 and later contain the fix for CVE-2022-32158. Splunk Enterprise 9.0 also addresses CVE-2022-32157. Splunk users are advised to upgrade vulnerable installations immediately. The issue only affects systems that use the deployment server feature, and Splunk Cloud Platform is not affected.
Who is affected and what are the workarounds?
According to Splunk advisory SVD-2022-0608, published on 16 August 2022, the affected versions are Splunk Enterprise 8.1 before 8.1.10.1 and 8.2.0 through 8.2.6. The advisory gives a CVSS score of 9.0, rated critical. Organizations that do not use deployment servers can switch the feature off with a command line setting without affecting the rest of the server. Splunk says the Splunk Cloud Platform does not offer or use deployment servers and is not affected, but customers who run their own deployment server should still upgrade to 9.0 or later.
How serious is the second flaw?
CVE-2022-32157, the missing authentication issue, is scored 7.5 in the National Vulnerability Database and is listed as a missing authentication weakness (CWE-306). Its remediation is to update the deployment server to 9.0 and then set up authentication between deployment servers and clients. Both flaws sit in the same feature, so one upgrade project can close them together.