Vulnerabilities > CVE-2017-5607 - Information Exposure vulnerability in Splunk

CVSS 3.5 - LOW

Attack vector

NETWORK

Attack complexity

MEDIUM

Privileges required

SINGLE

Confidentiality impact

PARTIAL

Integrity impact

NONE

Availability impact

NONE

network

splunk

CWE-200

nessus

exploit available

NVD

Published: 2017-04-10

Updated: 2019-03-20

Summary

Splunk Enterprise 5.0.x before 5.0.18, 6.0.x before 6.0.14, 6.1.x before 6.1.13, 6.2.x before 6.2.13.1, 6.3.x before 6.3.10, 6.4.x before 6.4.6, and 6.5.x before 6.5.3 and Splunk Light before 6.5.2 assigns the $C JS property to the global Window namespace, which might allow remote attackers to obtain sensitive logged-in username and version-related information via a crafted webpage.

Vulnerable Configurations

Part	Description	Count
Application	Splunk Splunk Splunk 6.2.0 Splunk Splunk 6.2.1 Splunk Splunk 6.2.2 Splunk Splunk 6.2.3 Splunk Splunk 6.2.4 Splunk Splunk 6.2.5 Splunk Splunk 6.2.6 Splunk Splunk 6.2.7 Splunk Splunk 6.2.8 Splunk Splunk 6.2.9 Splunk Splunk 6.2.10 Splunk Splunk 6.2.11 Splunk Splunk 6.3.0 Splunk Splunk 6.3.1 Splunk Splunk 6.3.2 Splunk Splunk 6.3.3 Splunk Splunk 6.3.4 Splunk Splunk 6.3.5 Splunk Splunk 6.4.0 Splunk Splunk 6.4.1 Splunk Splunk 6.4.2 Splunk Splunk 6.4.3 Splunk Splunk 6.4.4 Splunk Splunk 6.5.0 Splunk Splunk 6.5.1 Splunk Splunk 5.0.0 Splunk Splunk 5.0.1 Splunk Splunk 5.0.2 Splunk Splunk 5.0.3 Splunk Splunk 5.0.4 Splunk Splunk 5.0.5 Splunk Splunk 5.0.6 Splunk Splunk 5.0.7 Splunk Splunk 5.0.8 Splunk Splunk 5.0.9 Splunk Splunk 5.0.10 Splunk Splunk 5.0.11 Splunk Splunk 5.0.12 Splunk Splunk 5.0.13 Splunk Splunk 5.0.14 Splunk Splunk 5.0.15 Splunk Splunk 5.0.16 Splunk Splunk 5.0.17 Splunk Splunk 6.0.0 Splunk Splunk 6.0.1 Splunk Splunk 6.0.2 Splunk Splunk 6.0.3 Splunk Splunk 6.0.4 Splunk Splunk 6.0.5 Splunk Splunk 6.0.6 Splunk Splunk 6.0.7 Splunk Splunk 6.0.8 Splunk Splunk 6.0.9 Splunk Splunk 6.0.10 Splunk Splunk 6.0.11 Splunk Splunk 6.0.12 Splunk Splunk 6.0.13 Splunk Splunk 6.1.0 Splunk Splunk 6.1.1 Splunk Splunk 6.1.2 Splunk Splunk 6.1.3 Splunk Splunk 6.1.4 Splunk Splunk 6.1.5 Splunk Splunk 6.1.6 Splunk Splunk 6.1.7 Splunk Splunk 6.1.8 Splunk Splunk 6.1.9 Splunk Splunk 6.1.10 Splunk Splunk 6.1.11 Splunk Splunk 6.1.12 Splunk Splunk 6.2.12 Splunk Splunk 6.2.13 Splunk Splunk 6.3.6 Splunk Splunk 6.3.7 Splunk Splunk 6.3.8 Splunk Splunk 6.3.9 Splunk Splunk 6.4.5 Splunk Splunk 6.5.2	103

Common Weakness Enumeration (CWE)

CWE-200 - Information Exposure

Common Attack Pattern Enumeration and Classification (CAPEC)

Subverting Environment Variable Values
The attacker directly or indirectly modifies environment variables used by or controlling the target software. The attacker's goal is to cause the target software to deviate from its expected operation in a manner that benefits the attacker.
Footprinting
An attacker engages in probing and exploration activity to identify constituents and properties of the target. Footprinting is a general term to describe a variety of information gathering techniques, often used by attackers in preparation for some attack. It consists of using tools to learn as much as possible about the composition, configuration, and security mechanisms of the targeted application, system or network. Information that might be collected during a footprinting effort could include open ports, applications and their versions, network topology, and similar information. While footprinting is not intended to be damaging (although certain activities, such as network scans, can sometimes cause disruptions to vulnerable applications inadvertently) it may often pave the way for more damaging attacks.
Exploiting Trust in Client (aka Make the Client Invisible)
An attack of this type exploits a programs' vulnerabilities in client/server communication channel authentication and data integrity. It leverages the implicit trust a server places in the client, or more importantly, that which the server believes is the client. An attacker executes this type of attack by placing themselves in the communication channel between client and server such that communication directly to the server is possible where the server believes it is communicating only with a valid client. There are numerous variations of this type of attack.
Browser Fingerprinting
An attacker carefully crafts small snippets of Java Script to efficiently detect the type of browser the potential victim is using. Many web-based attacks need prior knowledge of the web browser including the version of browser to ensure successful exploitation of a vulnerability. Having this knowledge allows an attacker to target the victim with attacks that specifically exploit known or zero day weaknesses in the type and version of the browser used by the victim. Automating this process via Java Script as a part of the same delivery system used to exploit the browser is considered more efficient as the attacker can supply a browser fingerprinting method and integrate it with exploit code, all contained in Java Script and in response to the same web page request by the browser.
Session Credential Falsification through Prediction
This attack targets predictable session ID in order to gain privileges. The attacker can predict the session ID used during a transaction to perform spoofing and session hijacking.

Exploit-Db

description	Splunk Enterprise - Information Disclosure. CVE-2017-5607. Webapps exploit for Multiple platform
file	exploits/multiple/webapps/41779.txt
id	EDB-ID:41779
last seen	2017-03-31
modified	2017-03-31
platform	multiple
port
published	2017-03-31
reporter	Exploit-DB
source	https://www.exploit-db.com/download/41779/
title	Splunk Enterprise - Information Disclosure
type	webapps

Nessus

NASL family	CGI abuses
NASL id	SPLUNK_653.NASL
description	According to its self-reported version number, the version of Splunk running on the remote web server is Splunk Light 6.5.x prior to 6.5.3 or Splunk Enterprise 5.0.x prior to 5.0.18, 6.0.x prior to 6.0.14, 6.1.x prior to 6.1.13, 6.2.x prior to 6.2.13.1, 6.3.x prior to 6.3.10, 6.4.x prior to 6.4.6, or 6.5.x prior to 6.5.3. It is, therefore, affected by multiple vulnerabilities : - An information disclosure vulnerability exists due to various system information being assigned to the global window property
last seen	2020-06-01
modified	2020-06-02
plugin id	99235
published	2017-04-06
reporter	This script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/99235
title	Splunk Enterprise < 5.0.18 / 6.0.14 / 6.1.13 / 6.2.13.1 / 6.3.10 / 6.4.6 / 6.5.3 / Splunk Light < 6.5.3 Multiple Vulnerabilities

NASL family	CGI abuses
NASL id	SPLUNK_652.NASL
description	According to its self-reported version number, the version of Splunk Enterprise hosted on the remote web server is 5.0.x prior to 5.0.17, 6.0.x prior to 6.0.13, 6.1.x prior to 6.1.12, 6.2.x prior to 6.2.13, 6.3.x prior to 6.3.9, 6.4.x prior to 6.4.5, or 6.5.x prior to 6.5.2; or else it is Splunk Light prior to 6.5.2. It is, therefore, affected by multiple vulnerabilities : - A security bypass vulnerability exists in the libarchive component due to a failure to properly check hardlinks that contain payload data. An unauthenticated, remote attacker can exploit this to bypass sandbox restrictions. (CVE-2016-5418) - An out-of-bounds write error exists in the libarchive component in the get_line_size() function in archive_read_support_format_mtree.c that is triggered when parsing lines. An unauthenticated, remote attacker can exploit this to crash the library or disclose memory contents. (CVE-2016-8688) - An information disclosure vulnerability exists in Splunk Light due to various system information being assigned to the global window property
last seen	2020-06-01
modified	2020-06-02
plugin id	97100
published	2017-02-10
reporter	This script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/97100
title	Splunk Enterprise < 5.0.17 / 6.0.13 / 6.1.12 / 6.2.13 / 6.3.9 / 6.4.5 / 6.5.2 or Splunk Light < 6.5.2 Multiple Vulnerabilities

Packetstorm

data source	https://packetstormsecurity.com/files/download/141875/SPLUNK-ENTERPRISE-INFORMATION-THEFT.txt
id	PACKETSTORM:141875
last seen	2017-04-03
published	2017-04-01
reporter	hyp3rlinx
source	https://packetstormsecurity.com/files/141875/Splunk-Enterprise-Multiple-Version-Information-Disclosure.html
title	Splunk Enterprise Multiple Version Information Disclosure

Seebug

bulletinFamily	exploit
description	### Product: Splunk Enterprise Splunk provides the leading platform for Operational Intelligence. Customers use Splunk to search, monitor, analyze and visualize machine data. Splunk Enterprise, collects and analyzes high volumes of machine-generated data. ### Vulnerability Type: Javascript (JSON) Information Theft ### Security Issue: Attackers can siphon information from Splunk Enterprise if an authenticated Splunk user visits a malicious webpage. Some useful data gained is the currently logged in username and if remote user setting is enabled. After, the username can be use to Phish or Brute Force Splunk Enterprise login. Additional information stolen may aid in furthering attacks. Root cause is the global Window JS variable assignment of config?autoload=1 '$C'. e.g. ``` window.$C = {"BUILD_NUMBER": 207789, "SPLUNKD_PATH"... etc... } ``` To steal information we simply can define a function to be called when the `'$C'` JS property is "set" on webpage, for example. `Object.defineProperty( Object.prototype, "$C", { set:function(val){...` The Object prototype is a Object that every other object inherits from in JavaScript, if we create a setter on the name of our target in this case "$C", we can get/steal the value of this data, in this case it is very easy as it is assigned to global Window namespace. Affected Splunk Enterprise versions: ``` 6.5.x before 6.5.3 6.4.x before 6.4.6 6.3.x before 6.3.10 6.2.x before 6.2.13.1 6.1.x before 6.1.13 6.0.x before 6.0.14 5.0.x before 5.0.18 and Splunk Light before 6.5.2 ``` Vulnerability could allow a remote attacker to obtain logged-in username and Splunk version-related information via JavaScript. ### References: https://www.splunk.com/view/SP-CAAAPZ3 https://www.splunk.com/view/SP-CAAAPZ3#InformationLeakageviaJavaScriptCVE20175607 ### Exploit/POC: Reproduction: 1) Log into Splunk 2) place the below Javascript in webpage on another server. "Splunk-Data-Theft.html" ``` <script> Object.defineProperty( Object.prototype, "$C", { set:function(val){ //prompt("Splunk Timed out:\nPlease Login to Splunk\nUsername: "+val.USERNAME, "Password") for(var i in val){ alert(""+i+" "+val[i]); } } }); </script> <script src="https://VICTIM-IP:8000/en-US/config?autoload=1";></script> ``` 3) Visit the server hosting the "Splunk-Data-Theft.html" webpage, grab current authenticated user 4) Phish or brute force the application. ### Video POC URL: https://vimeo.com/210634562 ### Disclosure Timeline: Vendor Notification: November 30, 2016 Vendor Acknowledgement: December 2, 2016 Vendor Release Splunk 6.5.3 / Patch : March 30, 2017 March 31, 2017 : Public Disclosure [+] Disclaimer The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. All content (c). hyp3rlinx
id	SSV:92895
last seen	2017-11-19
modified	2017-04-05
published	2017-04-05
reporter	Root
title	Splunk Enterprise Information Theft (CVE-2017-5607)