CVE-2024-36991 PoC — Path Traversal on the “/modules/messaging/“ endpoint in Splunk Enterprise on Windows

Source

https://github.com/0xFZin/CVE-2024-36991

Associated Vulnerability

Title: Path Traversal on the “/modules/messaging/“ endpoint in Splunk Enterprise on Windows (CVE-2024-36991)
Description:In Splunk Enterprise on Windows versions below 9.2.2, 9.1.5, and 9.0.10, an attacker could perform a path traversal on the /modules/messaging/ endpoint in Splunk Enterprise on Windows. This vulnerability should only affect Splunk Enterprise on Windows.

Description

Exploit for CVE-2024-36991 , written by me, enumerates a handfull of things, not all, cause not needed.

Readme

# CVE 2024-36991
- A path-traversal vulnerability that allows an attacker to read files  from the system.

## Technical Summary
- **CVE**: 2024-36991 (Path Traversal)
- **Affected Systems**: Splunk Enterprise 9.2.1 , 9.1.4 , 9.0.9


## Legal Disclaimer
This tool is provided for authorized security assessments only. Unauthorized use violates:
- Computer Fraud and Abuse Act (US)
- Computer Misuse Act (UK/EU)

Usage implies acceptance of responsibility for proper authorization. All testing requires written consent from system owners.

### USAGE:
```bash
python3 exploit.py <URL:PORT>
```

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →