Exploitation Summary
EIP tracks 2 public exploits for CVE-2023-46214.
PoCs published by dyeat, nathan, Valentin Lobstein, h00die, including Metasploit module exploits/unix/http/splunk_xslt_authenticated_rce.
AI-analyzed exploit summary This repository contains a functional exploit for CVE-2023-46214, an RCE vulnerability in Splunk. The exploit leverages XSLT file upload and transformation to write a reverse shell script to disk and execute it.
Description
In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet language transformations (XSLT) that users supply. This means that an attacker can upload malicious XSLT which can result in remote code execution on the Splunk Enterprise instance.
Exploits (2)
This repository contains a functional exploit for CVE-2023-46214, an RCE vulnerability in Splunk. The exploit leverages XSLT file upload and transformation to write a reverse shell script to disk and execute it.
This Metasploit module exploits CVE-2023-46214, an authenticated RCE vulnerability in Splunk Enterprise versions 9.0.x before 9.0.7 and 9.1.x before 9.1.2. It uploads a malicious XSLT file to trigger arbitrary code execution via the 'runshellscript' functionality.
References (3)
Scores
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H