CVE-2023-32707

This exploit leverages CVE-2023-32707 to escalate privileges in Splunk by changing the password of a target user (e.g., admin) if the attacker's role has the 'edit_user' capability. It authenticates with provided credentials, checks the Splunk version, and sends a crafted request to modify the target user's password.

This is a functional exploit for CVE-2023-32707, which allows a low-privilege Splunk user with the 'edit_user' capability to escalate privileges by resetting the password of any target user, including admin accounts. The exploit automates the process by authenticating, checking version vulnerability, and forcing a password change via Splunk's REST API.

This Metasploit module exploits CVE-2023-32707, a privilege escalation vulnerability in Splunk where a low-privileged user with the 'edit_user' capability can escalate to admin by changing the admin password and uploading a malicious app for RCE.