Web Exploitation Attempt of CVE-2023-46214 Against Splunk Enterprise via Insecure XML Upload and Search

title: Web Exploitation Attempt of CVE-2023-46214 Against Splunk Enterprise via Insecure XML Upload and Search
id: ad87a17e-0d92-4557-bc23-84c7ae889156
related:
  - id: 04017cd5-621e-4ec4-a762-1f042fe3d3e5
    type: derived
  - id: ba5268de-4dd4-4d5c-8a90-2b5e6dc1aff8
    type: derived
status: test
description: This rule identifies HTTP POST requests to Splunk Enterprise web endpoints consistent with exploiting CVE-2023-46214 using public proof-of-concept behavior. It matches successful/redirecting responses alongside a specific upload request targeting shell.xsl with NO_BINARY_CHECK enabled and subsequent search result paths that reference Splunk dispatch output. The detection relies on webserver HTTP telemetry capturing request method, status codes, and full URI stem/query parameters.
references:
  - https://github.com/nathan31337/Splunk-RCE-poc/
  - https://blog.hrncirik.net/cve-2023-46214-analysis
  - https://advisory.splunk.com/advisories/SVD-2023-1104
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-46214/web_cve_2023_46214_rce_splunk_enterprise_poc.yml
author: Lars B. P. Frydenskov(Trifork Security), Huntrule Team
date: 2023-11-27
tags:
  - attack.lateral-movement
  - attack.t1210
  - cve.2023-46214
  - detection.emerging-threats
logsource:
  category: webserver
detection:
  selection_method_and_response:
    cs-method: POST
    sc-status:
      - 200
      - 302
  selection_uri_upload:
    cs-uri-stem|contains: /splunkd/__upload/indexing/preview
    cs-uri-query|contains|all:
      - NO_BINARY_CHECK=1
      - input.path=shell.xsl
  selection_uri_search:
    cs-uri-stem|contains|all:
      - /api/search/jobs
      - /results
    cs-uri-query|contains|all:
      - /opt/splunk/var/run/splunk/dispatch/
      - /shell.xsl
  condition: selection_method_and_response and 1 of selection_uri_*
falsepositives:
  - Unlikely
level: high
license: DRL-1.1