CVE-2010-2429

Vulnerability

Splunk versions 4.0 through 4.1.2 contain a cross-site scripting (XSS) vulnerability in the Splunk Web component [1]. When the server returns a “404 Not Found” response for a non-existent resource, it renders the contents of the HTTP Referer header without proper escaping [1]. This code path is only reachable when Internet Explorer is used, as Firefox escapes the special characters "< and > in the rendered link [1]. The vulnerability is present in all Splunk Web deployments; light forwarders with Splunk Web disabled are not affected [1].

Exploitation

An attacker can trick a Splunk user into visiting a specially crafted web page that sends a request to a vulnerable Splunk server with a malicious Referer header containing arbitrary HTML or JavaScript [1]. The attacker does not need authentication, but user interaction is required (the victim must navigate to the attacker-controlled page while using Internet Explorer). The XSS payload is then reflected in the 404 error page served to the victim [1].

Impact

Successful exploitation allows an attacker to inject arbitrary web script or HTML that executes in the context of the Splunk Web interface [1]. This can lead to session hijacking, phishing, or other malicious actions within the authenticated Splunk session. The impact depends on the privileges of the victim user; at a minimum, it results in unauthenticated information disclosure or UI manipulation [1].

Mitigation

Splunk released version 4.1.3 on 2010-06-07 to fix this vulnerability [1]. All instances running Splunk 4.0 through 4.1.2 should be upgraded to 4.1.3 or later [1]. As a workaround, Splunk recommends applying the Splunk Hardening Standards to reduce risk and impact [1].