Possible CVE-2023-46214 RCE Probe Against Splunk Enterprise via XSL POST Requests

title: Possible CVE-2023-46214 RCE Probe Against Splunk Enterprise via XSL POST Requests
id: 62bd0e1a-0abd-4ca1-acca-30efb2c7dc99
related:
  - id: ba5268de-4dd4-4d5c-8a90-2b5e6dc1aff8
    type: derived
  - id: 04017cd5-621e-4ec4-a762-1f042fe3d3e5
    type: derived
status: test
description: This rule flags web requests that appear to probe Splunk Enterprise for CVE-2023-46214-style remote code execution behavior. It matches HTTP POST traffic where the URI query includes both "NO_BINARY_CHECK=1" and "input.path", and the request targets an endpoint ending in ".xsl" while returning HTTP status codes 200 or 302. Attackers may use this pattern to trigger insecure XML/XSL handling paths, and the rule relies on webserver telemetry fields for HTTP method, URI query contents, URI extension, and response status.
references:
  - https://github.com/nathan31337/Splunk-RCE-poc/
  - https://blog.hrncirik.net/cve-2023-46214-analysis
  - https://advisory.splunk.com/advisories/SVD-2023-1104
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-46214/web_cve_2023_46214_rce_splunk_enterprise.yml
author: Nasreddine Bencherchali (Nextron Systems), Bhavin Patel (STRT), Huntrule Team
date: 2023-11-27
tags:
  - attack.lateral-movement
  - attack.t1210
  - cve.2023-46214
  - detection.emerging-threats
logsource:
  category: webserver
detection:
  selection:
    cs-method: POST
    cs-uri-query|contains|all:
      - NO_BINARY_CHECK=1
      - input.path
    cs-uri-query|endswith: .xsl
    sc-status:
      - 200
      - 302
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1