Exploitation Summary
EIP tracks 3 public exploits for CVE-2023-32707.
PoCs published by Redway Security, 9xN, Mr Hack (try_to_hack) Santiago Lopez, Heyder Andrade, Redway Security <redwaysecurity.com>, including Metasploit module exploits/multi/http/splunk_privilege_escalation_cve_2023_32707.
AI-analyzed exploit summary This exploit leverages CVE-2023-32707 to escalate privileges in Splunk by changing the password of a target user (e.g., admin) if the attacker's role has the 'edit_user' capability. It authenticates with provided credentials, checks the Splunk version, and sends a crafted request to modify the target user's password.
Description
In versions of Splunk Enterprise below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform below version 9.0.2303.100, a low-privileged user who holds a role that has the ‘edit_user’ capability assigned to it can escalate their privileges to that of the admin user by providing specially crafted web requests.
Exploits (3)
This exploit leverages CVE-2023-32707 to escalate privileges in Splunk by changing the password of a target user (e.g., admin) if the attacker's role has the 'edit_user' capability. It authenticates with provided credentials, checks the Splunk version, and sends a crafted request to modify the target user's password.
This is a functional exploit for CVE-2023-32707, which allows a low-privilege Splunk user with the 'edit_user' capability to escalate privileges by resetting the password of any target user, including admin accounts. The exploit automates the process by authenticating, checking version vulnerability, and forcing a password change via Splunk's REST API.
This Metasploit module exploits CVE-2023-32707, a privilege escalation vulnerability in Splunk where a low-privileged user with the 'edit_user' capability can escalate to admin by changing the admin password and uploading a malicious app for RCE.
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H