Unauthenticated Log Injection in Splunk Enterprise

CVE-2023-32712

Summary

In certain versions of Splunk Enterprise and Universal Forwarder, an attacker can exploit a vulnerability that allows for injection of ANSI escape codes into log files. If these logs are read by a vulnerable terminal application, it may lead to potential code execution. This exploitation requires user interaction to read the manipulated log file locally and may vary based on the permissions set in the terminal application. While more recent version configurations mitigate this risk, it’s crucial for users to assess their system settings and log handling practices to prevent possible unauthorized access.

References