CVE-2022-43571 PoC — Remote Code Execution through dashboard PDF generation component in Splunk Enterprise

Source

https://github.com/ohnonoyesyes/CVE-2022-43571

Associated Vulnerability

Title:Remote Code Execution through dashboard PDF generation component in Splunk Enterprise (CVE-2022-43571)
Description:In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can execute arbitrary code through the dashboard PDF generation component.

Readme

# CVE-2022-43571

CVE-2022-43571 Splunk RCE – my personal journey to color your life
Only because I got the statement from my IT, there are no reasons for a SPLUNK update, I analyzed this vulnerability CVE-2022-43571 to prove the opposite for a remote code execution. Here is my exploit.

If I had found this vulnerability, I would like to name this „colorful sparklines“ ….. ;-)

@SPLUNK you should not name the vulnerability nor address any details in your code. It was a fast pointer into right direction ;-)
/splunk/lib/python3.7/site-packages/splunk/pdf/pdfgen_utils.py

https://psytester.github.io/CVE-2022-43571_SPLUNK_RCE/

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →