Name:Splunk XSS Privilege Escalation via Custom Urls in Dashboard id:01e1e386-7656-4f36-a55a-52fe39b04a96 version:7 date:None author:Rod Soto, Chase Franklin status:production type:Hunting Description:This is a composed hunting search that looks for POST requests to splunk_internal_metrics/data/ui/views which can be used to elevate privileges on the Splunk server via custom urls. The way to find privilege escalation is by looking at created users with high privielges after payload has been executed. This search looks at POST request and then looks at created users privileges. Data_source:
-Splunk
search:`splunkd_ui` method=POST /*/data/ui/views* | stats values(method) as method by _time index, sourcetype, host | eval event="post_request" | append [| search `audittrail` action="edit_user" operation="create" | rex field=_raw "object=\"(?<newUser>.*)\"" | stats count values(operation) as operation values(splunk_server) as splunk_server values(user) as user by _time index, sourcetype, host, newUser | eval event="create_user"] | sort - _time | transaction host startswith=event="post_request" endswith=event="create_user" maxspan=10m | table _time index, sourcetype, host, method, user, splunk_server, operation, event, newUser eventcount | `splunk_xss_privilege_escalation_via_custom_urls_in_dashboard_filter`
how_to_implement:Requires access to internal indexes _audit and _internal. known_false_positives:This is a hunting search and requires operator to search for specific indicators of user creation in proximity to POST requests against vulnerable endpoint. It is not possible to detect payload during runtime. References: -https://advisory.splunk.com/ drilldown_searches:
: analytic_story:['Splunk Vulnerabilities']
