CVE-2023-40598: Splunk Enterprise RCE Vulnerability

CVE-2023-40598 Overview

CVE-2023-40598 is a command injection vulnerability affecting Splunk Enterprise and Splunk Cloud Platform. An attacker can create an external lookup that calls a legacy internal function, which allows the insertion of code into the Splunk platform installation directory. Once code is placed in this location, a user can execute arbitrary code on the Splunk platform instance, potentially leading to full system compromise.

Critical Impact

Authenticated attackers can leverage legacy internal functions through external lookups to achieve arbitrary code execution on Splunk Enterprise instances, potentially compromising sensitive log data and downstream systems.

Affected Products

• Splunk Enterprise versions below 8.2.12
• Splunk Enterprise versions below 9.0.6
• Splunk Enterprise versions below 9.1.1
• Splunk Cloud Platform (specific affected versions detailed in vendor advisory)

Discovery Timeline

• 2023-08-30 - CVE-2023-40598 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-40598

Vulnerability Analysis

This vulnerability involves two critical weaknesses: Command Injection (CWE-77) and Missing Authentication for Critical Function (CWE-306). The flaw exists in how Splunk Enterprise handles external lookup definitions, specifically when these lookups invoke legacy internal functions that were not properly secured.

The attack chain begins when an attacker with valid credentials creates a malicious external lookup configuration. This lookup is crafted to call a legacy internal function that lacks proper access controls. Through this function, the attacker can write arbitrary code to the Splunk installation directory. The written code can then be executed within the context of the Splunk platform, granting the attacker the same privileges as the Splunk service account.

The network-accessible nature of this vulnerability, combined with the low attack complexity once authenticated, makes it particularly dangerous in enterprise environments where Splunk often has access to sensitive operational and security data.

Root Cause

The root cause stems from insufficient access controls on legacy internal functions that remain callable through the external lookup mechanism. These functions were not designed with modern security boundaries in mind and lack proper validation of the calling context. Additionally, the ability to write to the Splunk installation directory through these functions represents a critical gap in file system access controls.

Attack Vector

The attack requires network access to a vulnerable Splunk Enterprise instance and valid user credentials (low privilege requirements). The attacker crafts a specially designed external lookup definition that references the vulnerable legacy internal function. When this lookup is processed, the internal function executes without proper authorization checks, allowing the attacker to inject malicious code into the Splunk installation directory. Subsequent execution of this code grants the attacker arbitrary code execution capabilities on the target system.

The vulnerability is exploited through Splunk's external lookup feature, which normally allows administrators to define custom lookup scripts. By abusing the legacy function call mechanism, attackers bypass the intended restrictions on what these lookups can execute, effectively turning the lookup feature into a code injection vector.

Detection Methods for CVE-2023-40598

Indicators of Compromise

• Unusual external lookup definitions that reference internal functions or contain suspicious command patterns
• Unexpected file modifications or new files appearing in the Splunk installation directory ($SPLUNK_HOME)
• Anomalous process execution originating from the Splunk service account
• Authentication events followed by external lookup creation from the same user session

Detection Strategies

• Monitor Splunk audit logs for creation or modification of external lookup definitions, especially those referencing internal functions
• Implement file integrity monitoring on the Splunk installation directory to detect unauthorized code placement
• Review the Splunk Research Application Analysis for specific detection signatures and correlation rules
• Alert on unusual command execution patterns from the Splunk service context

Monitoring Recommendations

• Enable verbose audit logging in Splunk Enterprise to capture all configuration changes related to lookups
• Deploy endpoint detection and response (EDR) solutions to monitor for suspicious process spawning from Splunk processes
• Establish baseline behavior for external lookup usage and alert on deviations
• Implement network monitoring for unusual outbound connections from Splunk infrastructure

How to Mitigate CVE-2023-40598

Immediate Actions Required

• Upgrade Splunk Enterprise to version 8.2.12, 9.0.6, 9.1.1, or later immediately
• Audit existing external lookup definitions for any suspicious configurations
• Review user accounts with permissions to create or modify lookups and apply principle of least privilege
• Monitor for indicators of compromise as described above

Patch Information

Splunk has released security patches addressing this vulnerability. Organizations should upgrade to the following minimum versions:

• Splunk Enterprise 8.2.12 or later (for 8.2.x branch)
• Splunk Enterprise 9.0.6 or later (for 9.0.x branch)
• Splunk Enterprise 9.1.1 or later (for 9.1.x branch)

For detailed patch information and upgrade guidance, refer to the Splunk Security Advisory SVD-2023-0807.

Workarounds

• Restrict permissions for creating and modifying external lookups to only trusted administrative accounts
• Implement additional network segmentation to limit access to Splunk management interfaces
• Deploy file integrity monitoring on the Splunk installation directory as a compensating control until patching is complete
• Consider temporarily disabling external lookup functionality if not business-critical while awaiting patch deployment

# Audit existing external lookup definitions in Splunk
$SPLUNK_HOME/bin/splunk btool transforms list --debug | grep -A5 "external_cmd"

# Review lookup permissions in authorize.conf
$SPLUNK_HOME/bin/splunk btool authorize list --debug | grep -i lookup