CVE-2024-53247: Splunk Enterprise RCE Vulnerability

CVE-2024-53247 Overview

CVE-2024-53247 is a remote code execution (RCE) vulnerability affecting Splunk Enterprise and the Splunk Secure Gateway app on Splunk Cloud Platform. The flaw allows a low-privileged authenticated user, one who does not hold the admin or power Splunk roles, to execute arbitrary code on affected systems. The underlying weakness is classified as deserialization of untrusted data [CWE-502]. Splunk addressed the issue in Splunk Enterprise versions 9.3.2, 9.2.4, and 9.1.7, and in Splunk Secure Gateway versions 3.4.261 and 3.7.13.

Critical Impact
An authenticated attacker with minimal privileges can achieve full remote code execution on the Splunk host, compromising confidentiality, integrity, and availability of log data and the underlying system.

Affected Products

Splunk Enterprise versions below 9.3.2, 9.2.4, and 9.1.7
Splunk Secure Gateway app versions below 3.4.261 and 3.7.13
Splunk Cloud Platform instances running vulnerable Secure Gateway builds

Discovery Timeline

2024-12-10 - CVE-2024-53247 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2024-53247

Vulnerability Analysis

The vulnerability resides in the Splunk Secure Gateway app, which ships with Splunk Enterprise and is also deployed on Splunk Cloud Platform. The flaw stems from insecure deserialization of untrusted data [CWE-502] processed by the Secure Gateway component. An attacker who authenticates to Splunk with a standard, non-privileged role can submit crafted serialized input that the application deserializes without adequate validation. The deserialization process instantiates attacker-controlled objects, leading to arbitrary code execution in the context of the Splunk service.

The EPSS probability of exploitation is 4.099% with a percentile of 88.705, placing the issue in the upper tier of likely-exploited vulnerabilities tracked by EPSS.

Root Cause

The root cause is the use of an unsafe deserialization routine that processes data from authenticated user sessions without enforcing type restrictions or integrity checks. When the Secure Gateway endpoint accepts serialized payloads, it reconstructs Python objects from the input stream. Attacker-controlled gadget chains executed during reconstruction trigger code execution before any application-level authorization logic can intervene.

Attack Vector

The attack vector is network-based and requires authentication with low privileges. The attacker does not need admin or power Splunk roles, which significantly broadens the pool of accounts that can be abused, including compromised analyst or read-only accounts. No user interaction is required. After authenticating to the Splunk web interface or REST API, the attacker submits a serialized payload to a Secure Gateway endpoint and obtains code execution as the Splunk process user. See the Splunk Security Advisory SVD-2024-1205 for vendor technical details.

No verified public proof-of-concept code is available at this time. The vulnerability mechanism is described in prose only; see the vendor advisory for additional technical detail.

Detection Methods for CVE-2024-53247

Indicators of Compromise

Unexpected child processes spawned by the Splunk daemon (splunkd), particularly shells, scripting interpreters, or networking utilities.
Anomalous outbound network connections initiated from Splunk Enterprise hosts to unknown external endpoints.
New or modified files in Splunk app directories, including unauthorized changes under etc/apps/splunk_secure_gateway/.
Authentication events for low-privileged accounts immediately followed by Secure Gateway REST API requests with large or binary payloads.

Detection Strategies

Monitor Splunk audit logs for non-admin users invoking Secure Gateway endpoints, especially routes that accept serialized data.
Inspect process-execution telemetry on Splunk hosts for splunkd parenting unusual command-line activity.
Correlate authentication events with subsequent process creation and outbound network activity to identify post-exploitation behavior.

Monitoring Recommendations

Enable verbose audit logging for the Splunk Secure Gateway app and forward events to an independent log store.
Alert on Splunk role-permission changes and on creation of new users with elevated capabilities.
Baseline normal Secure Gateway API usage and flag deviations in request size, frequency, or payload content type.

How to Mitigate CVE-2024-53247

Immediate Actions Required

Upgrade Splunk Enterprise to version 9.3.2, 9.2.4, 9.1.7, or later according to the deployed release branch.
Update the Splunk Secure Gateway app to version 3.4.261 or 3.7.13 or later on Splunk Cloud Platform.
Audit Splunk user accounts and remove unnecessary low-privileged accounts that could be abused for authenticated exploitation.
Rotate credentials for accounts that may have been exposed on unpatched systems.

Patch Information

Splunk released fixed versions documented in Splunk Security Advisory SVD-2024-1205. Apply Splunk Enterprise 9.3.2, 9.2.4, or 9.1.7 for self-managed deployments. For Splunk Cloud Platform, ensure the Splunk Secure Gateway app is upgraded to 3.4.261 or 3.7.13 or later. Splunk Cloud customers receive the patched Secure Gateway through standard cloud maintenance.

Workarounds

Disable or remove the Splunk Secure Gateway app if it is not required for operations.
Restrict network access to Splunk management interfaces using firewall rules and limit access to trusted administrative networks.
Enforce strong authentication, including multi-factor authentication, to reduce the risk of credential-based access by attackers.

bash

# Disable the Splunk Secure Gateway app as a temporary workaround
# Run on the Splunk Enterprise host
cd $SPLUNK_HOME/etc/apps/splunk_secure_gateway
mv local local.disabled 2>/dev/null
$SPLUNK_HOME/bin/splunk disable app splunk_secure_gateway -auth admin:<password>
$SPLUNK_HOME/bin/splunk restart