CVE-2022-43571
HIGHAuthenticated RCE in Splunk (SimpleXML dashboard PDF generation)
Title source: metasploitExploitation Summary
EIP tracks 2 public exploits for CVE-2022-43571.
PoCs published by ohnonoyesyes, Maksim Rogov, Danylo Dmytriiev, psytester, including Metasploit module exploits/multi/http/splunk_auth_rce_cve_2022_43571.
AI-analyzed exploit summary This repository contains a writeup and analysis of CVE-2022-43571, a remote code execution vulnerability in Splunk. The author describes their journey to exploit the vulnerability, which involves the Splunk PDF generation utility, but no actual exploit code is provided in the repository.
Description
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can execute arbitrary code through the dashboard PDF generation component.
Exploits (2)
This repository contains a writeup and analysis of CVE-2022-43571, a remote code execution vulnerability in Splunk. The author describes their journey to exploit the vulnerability, which involves the Splunk PDF generation utility, but no actual exploit code is provided in the repository.
This Metasploit module exploits CVE-2022-43571, an authenticated RCE vulnerability in Splunk Enterprise. It injects arbitrary Python code into style parameters of a SimpleXML dashboard, which executes when a user triggers the PDF export function.
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H