CVE-2024-36983: Splunk Enterprise RCE Vulnerability

CVE-2024-36983 Overview

CVE-2024-36983 is a command injection vulnerability [CWE-77] affecting Splunk Enterprise and Splunk Cloud Platform. An authenticated user can create an external lookup that invokes a legacy internal function. That function allows the attacker to write code into the Splunk platform installation directory and execute arbitrary code on the instance.

The flaw affects Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10, and Splunk Cloud Platform versions below 9.1.2312.109 and 9.1.2308.207. Exploitation requires authenticated access but no user interaction.

Critical Impact
Authenticated attackers can achieve arbitrary code execution on the Splunk platform instance, compromising the confidentiality, integrity, and availability of ingested security telemetry.

Affected Products

Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10
Splunk Cloud Platform versions below 9.1.2312.109
Splunk Cloud Platform versions below 9.1.2308.207

Discovery Timeline

2024-07-01 - CVE-2024-36983 published to NVD
2024-07-01 - Splunk publishes advisory SVD-2024-0703
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-36983

Vulnerability Analysis

The vulnerability resides in Splunk's external lookup mechanism. External lookups let users enrich search results by calling scripts or commands defined in lookup configurations. Splunk retained a legacy internal function reachable through this pathway.

An authenticated user can craft an external lookup definition that invokes this legacy function. The function accepts input that is not properly neutralized before being used to write files into the Splunk platform installation directory. Once attacker-controlled code is present in a trusted directory, Splunk executes it in the context of the Splunk service.

The issue is classified under CWE-77: Improper Neutralization of Special Elements used in a Command. Because the Splunk service typically runs with elevated privileges on the host, the resulting code execution gives an attacker broad control over the Splunk instance and any data it processes.

Root Cause

The root cause is the retention of a legacy internal function that remains reachable from the external lookup interface. Input passed through the lookup is not sanitized before being used to place files inside the installation directory, breaking the trust boundary between authenticated user input and trusted server-side code paths.

Attack Vector

The attack vector is network-based and requires an authenticated Splunk account with permission to create lookups. The attacker defines a malicious external lookup, triggers it, and the legacy function writes attacker-controlled code into the Splunk installation directory where it is executed by the platform. See the Splunk Security Advisory SVD-2024-0703 for vendor details.

No verified public proof-of-concept code is available. Refer to the Splunk Research Application Analysis for detection guidance published by the vendor.

Detection Methods for CVE-2024-36983

Indicators of Compromise

New or modified files appearing under the Splunk installation directory ($SPLUNK_HOME) that were not deployed by an administrator or app package.
Unusual lookup stanzas in transforms.conf that reference external scripts, binaries, or unexpected file paths.
Child processes spawned by splunkd executing shells, interpreters, or system utilities not associated with normal search workloads.
Outbound network connections initiated from the Splunk service to untrusted hosts following lookup execution.

Detection Strategies

Audit transforms.conf across search heads and indexers for external lookup definitions, and validate each against approved application content.
Inspect Splunk _audit and _internal indexes for lookup creation events and search commands invoking custom external lookups by low-privilege users.
Alert on process-execution telemetry showing splunkd spawning python, sh, bash, cmd.exe, or powershell.exe outside expected search app contexts.
Apply the vendor-published detection content from the Splunk Research Application Analysis.

Monitoring Recommendations

Enable file integrity monitoring on $SPLUNK_HOME/etc/ and $SPLUNK_HOME/bin/ to catch unauthorized additions.
Forward Splunk internal logs and host process telemetry to a centralized analytics platform for correlation across search heads and indexers.
Review role and capability assignments to identify accounts holding the schedule_search or lookup-editing capabilities that are not required for their function.

How to Mitigate CVE-2024-36983

Immediate Actions Required

Upgrade Splunk Enterprise to 9.2.2, 9.1.5, 9.0.10, or later per the Splunk Security Advisory SVD-2024-0703.
Confirm Splunk Cloud Platform instances are running 9.1.2312.109, 9.1.2308.207, or later, coordinating with Splunk support where applicable.
Review and revoke unnecessary lookup-editing and search-scheduling capabilities from non-administrative roles.
Audit existing external lookup definitions and remove any that cannot be attributed to approved applications.

Patch Information

Splunk addressed the issue in Splunk Enterprise 9.2.2, 9.1.5, and 9.0.10, and in Splunk Cloud Platform 9.1.2312.109 and 9.1.2308.207. The fix removes the reachable legacy internal function from the external lookup path. Refer to the vendor advisory SVD-2024-0703 for the authoritative remediation guidance.

Workarounds

Restrict the edit_lookups and related capabilities to trusted administrators until the patch is applied.
Disable or remove non-essential custom external lookups on affected instances.
Enforce role-based access control so that low-privilege users cannot create or modify lookup configurations.
Monitor $SPLUNK_HOME for unexpected file writes and alert on anomalous splunkd child processes.

bash

# Verify installed Splunk version on affected hosts
$SPLUNK_HOME/bin/splunk version

# List external lookup definitions across apps for review
grep -R "external_cmd" $SPLUNK_HOME/etc/apps/*/local/transforms.conf \
                       $SPLUNK_HOME/etc/apps/*/default/transforms.conf