Unauthenticated Log Injection in Splunk IT Service Intelligence (ITSI)

CVE-2023-4571

Summary

In vulnerable versions of Splunk IT Service Intelligence (ITSI), malicious actors can exploit a code injection vulnerability by injecting ANSI escape codes into log files. When users read these log files with a vulnerable terminal application, the injected escape codes can execute unwanted commands on their systems. Although this vulnerability does not directly impact Splunk ITSI, it poses a risk based on the permissions of the terminal application and how users interact with malicious log files. Successful exploitation requires users to inadvertently use a terminal that processes these escape codes, further emphasizing the need for caution when handling log files from Splunk ITSI.

References