CVE-2024-36985: Splunk Enterprise RCE Vulnerability

CVE-2024-36985 Overview

CVE-2024-36985 is a Remote Code Execution (RCE) vulnerability affecting Splunk Enterprise that allows low-privileged users to execute arbitrary code on the target system. The vulnerability exists in the handling of external lookups that reference the splunk_archiver application, enabling attackers with minimal privileges to bypass security controls and achieve code execution without requiring admin or power Splunk roles.

Critical Impact

Low-privileged attackers can achieve Remote Code Execution on vulnerable Splunk Enterprise instances through malicious external lookup configurations, potentially compromising the entire Splunk infrastructure and any connected data sources.

Affected Products

• Splunk Enterprise versions below 9.2.2
• Splunk Enterprise versions below 9.1.5
• Splunk Enterprise versions below 9.0.10

Discovery Timeline

• 2024-07-01 - CVE-2024-36985 published to NVD
• 2025-03-07 - Last updated in NVD database

Technical Details for CVE-2024-36985

Vulnerability Analysis

This vulnerability represents a significant privilege escalation and Remote Code Execution risk in Splunk Enterprise deployments. The flaw stems from improper function argument handling (CWE-687) within the external lookup functionality, specifically when referencing the splunk_archiver application.

The attack requires only a low-privileged user account—one that does not need admin or power Splunk roles—to exploit. This significantly lowers the barrier for exploitation, as many organizations may have numerous user accounts with basic access that could potentially be leveraged. Once exploited, an attacker gains the ability to execute arbitrary code on the Splunk server, which could lead to complete system compromise, data exfiltration, lateral movement within the network, or disruption of critical security monitoring capabilities.

Root Cause

The root cause of CVE-2024-36985 lies in the improper handling of function arguments (CWE-687) within Splunk Enterprise's external lookup mechanism. When external lookups reference the splunk_archiver application, insufficient validation and access controls allow unauthorized code execution paths to be triggered by users who should not have such capabilities. The vulnerability demonstrates a breakdown in the principle of least privilege, where the external lookup feature inadvertently grants elevated execution capabilities to low-privileged accounts.

Attack Vector

The attack is conducted over the network and requires low-privilege authentication to the target Splunk Enterprise instance. An attacker would craft a malicious external lookup configuration that references the splunk_archiver application. When this lookup is triggered, it exploits the improper argument handling to achieve code execution in the context of the Splunk server process.

The exploitation path involves:

1. Authenticating as a low-privileged user to Splunk Enterprise
2. Creating or modifying an external lookup configuration
3. Referencing the vulnerable splunk_archiver application
4. Triggering the lookup to execute arbitrary code on the server

For detailed technical analysis and detection patterns, see the Splunk Research Application Analysis.

Detection Methods for CVE-2024-36985

Indicators of Compromise

• Unusual external lookup activity referencing the splunk_archiver application
• Unexpected process execution originating from Splunk server processes
• Low-privileged user accounts accessing or modifying lookup configurations
• Anomalous network connections from Splunk servers to unexpected destinations

Detection Strategies

• Monitor Splunk audit logs for external lookup creation or modification events involving splunk_archiver
• Implement alerting on unusual process spawning from Splunk daemon processes
• Review access patterns for low-privileged users interacting with lookup configurations
• Deploy endpoint detection to identify suspicious command execution chains

Monitoring Recommendations

• Enable and review Splunk's internal audit logging for configuration changes
• Implement real-time alerting on external lookup modifications
• Monitor system process trees for unexpected child processes of Splunk services
• Utilize Splunk's own detection rules available at the Splunk Research Application Analysis

How to Mitigate CVE-2024-36985

Immediate Actions Required

• Upgrade Splunk Enterprise to version 9.2.2, 9.1.5, or 9.0.10 or later immediately
• Audit all external lookup configurations for references to splunk_archiver
• Review and restrict permissions for low-privileged user accounts
• Monitor for indicators of compromise before and after patching

Patch Information

Splunk has released security updates addressing this vulnerability. Organizations should upgrade to the following minimum versions:

• Splunk Enterprise 9.2.2 or later for the 9.2.x branch
• Splunk Enterprise 9.1.5 or later for the 9.1.x branch
• Splunk Enterprise 9.0.10 or later for the 9.0.x branch

For complete details, refer to the Splunk Security Advisory SVD-2024-0705.

Workarounds

• Disable or remove the splunk_archiver application if it is not required for operations
• Restrict external lookup creation permissions to only trusted administrator accounts
• Implement network segmentation to limit the impact of potential compromise
• Enable enhanced audit logging to detect exploitation attempts

# Verify current Splunk Enterprise version
/opt/splunk/bin/splunk version

# Review external lookup configurations
/opt/splunk/bin/splunk search "| rest /services/data/transforms/lookups | search type=external"

# Check for splunk_archiver application status
/opt/splunk/bin/splunk display app splunk_archiver