CVE-2011-4642
Splunk 4.2.x - Authenticated Remote Code Execution via mappy.py Python Class Access
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2011-4642.
PoCs published by Gary O'Leary-Steele, Gary O, , # Vulnerability discovery and exploit, including Metasploit module exploits/multi/http/splunk_mappy_exec.
AI-analyzed exploit summary This exploit targets CVE-2011-4644, a vulnerability in Splunk that allows remote authentication bypass and potential remote code execution. The script includes functionality for brute-forcing credentials, interacting with Splunk's web and management interfaces, and leveraging session keys for further exploitation.
Description
mappy.py in Splunk Web in Splunk 4.2.x before 4.2.5 does not properly restrict use of the mappy command to access Python classes, which allows remote authenticated administrators to execute arbitrary code by leveraging the sys module in a request to the search application, as demonstrated by a cross-site request forgery (CSRF) attack, aka SPL-45172.
Exploits (2)
This exploit targets CVE-2011-4644, a vulnerability in Splunk that allows remote authentication bypass and potential remote code execution. The script includes functionality for brute-forcing credentials, interacting with Splunk's web and management interfaces, and leveraging session keys for further exploitation.
This Metasploit module exploits a command execution vulnerability in Splunk's 'mappy' search command (CVE-2011-4642) by injecting Python code via base64-encoded payloads. It authenticates as an admin user and executes arbitrary commands on the target system.