# Splunk Enterprise在Windows上的“/modules/messaging/”端点存在路径穿越漏洞
## 漏洞概述
在Splunk Enterprise Windows版本中，存在一个路径遍历漏洞，攻击者可以通过/modules/messaging/端点进行路径遍历攻击。
## 影响版本
- 低于9.2.2的版本
- 低于9.1.5的版本
- 低于9.0.10的版本
## 漏洞细节
攻击者可以利用此漏洞在Splunk Enterprise Windows版本上进行路径遍历攻击，通过/modules/messaging/端点访问受限文件或目录。
## 影响
此漏洞仅影响Windows上的Splunk Enterprise版本。
| # | POC 描述 | 源链接 | 神龙链接 |
|---|---|---|---|
| 1 | POC for CVE-2024-36991: This exploit will attempt to read Splunk /etc/passwd file. | https://github.com/bigb0x/CVE-2024-36991 | POC详情 |
| 2 | Path Traversal On The "/Modules/Messaging/" Endpoint In Splunk Enterprise On Windows | https://github.com/Mr-xn/CVE-2024-36991 | POC详情 |
| 3 | CVE-2024-36991: Path traversal that affects Splunk Enterprise on Windows versions below 9.2.2, 9.1.5, and 9.0.10. | https://github.com/th3gokul/CVE-2024-36991 | POC详情 |
| 4 | Path traversal vulnerability in Splunk Enterprise on Windows | https://github.com/sardine-web/CVE-2024-36991 | POC详情 |
| 5 | Path traversal vulnerability in Splunk Enterprise on Windows versions below 9.2.2, 9.1.5, and 9.0.10 that allows reading sensitive files. | https://github.com/Cappricio-Securities/CVE-2024-36991 | POC详情 |
| 6 | Critical Splunk Vulnerability CVE-2024-36991: Patch Now to Prevent Arbitrary File Reads | https://github.com/jaytiwari05/CVE-2024-36991 | POC详情 |
| 7 | This binary POC automates the exploitation of CVE-2024-36991 by sending crafted curl requests to a vulnerable Splunk instance. It retrieves sensitive files and saves them locally for further analysis. The script is modular, allowing users to target specific file categories (e.g., credentials, logs, configurations). | https://github.com/TcchSquad/CVE-2024-36991-Tool | POC详情 |
| 8 | Proof of Concept for CVE-2024-36991. Path traversal for Splunk versions below 9.2.2, 9.1.5, and 9.0.10 for Windows which allows arbitrary file read. | https://github.com/gunzf0x/CVE-2024-36991 | POC详情 |
| 9 | The modified version of the original script can be described as a Proof of Concept (PoC) Exploit Script for CVE-2024-36991, designed to read sensitive files from a vulnerable Splunk Enterprise instance by leveraging path traversal techniques. | https://github.com/xploitnik/CVE-2024-36991-modified | POC详情 |
| 10 | In Splunk Enterprise on Windows versions below 9.2.2, 9.1.5, and 9.0.10, an attacker could perform a path traversal on the /modules/messaging/ endpoint in Splunk Enterprise on Windows. This vulnerability should only affect Splunk Enterprise on Windows. | https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-36991.yaml | POC详情 |
| 11 | None | https://github.com/Threekiii/Awesome-POC/blob/master/Web%E5%BA%94%E7%94%A8%E6%BC%8F%E6%B4%9E/Splunk%20Enterprise%20Windows%20%E5%B9%B3%E5%8F%B0%20messaging%20%E7%9B%AE%E5%BD%95%E9%81%8D%E5%8E%86%E6%BC%8F%E6%B4%9E%20CVE-2024-36991.md | POC详情 |