diff --git a/lookups/splunk_risky_command.yml b/lookups/splunk_risky_command.yml index ece0089986..22ddd339e4 100644 --- a/lookups/splunk_risky_command.yml +++ b/lookups/splunk_risky_command.yml @@ -1,5 +1,5 @@ description: A list of Risky Splunk Command that are candidates for abuse -filename: splunk_risky_command_20240601.csv +filename: splunk_risky_command_20240722.csv name: splunk_risky_command default_match: 'false' match_type: WILDCARD(splunk_risky_command) diff --git a/lookups/splunk_risky_command_20240601.csv b/lookups/splunk_risky_command_20240722.csv similarity index 77% rename from lookups/splunk_risky_command_20240601.csv rename to lookups/splunk_risky_command_20240722.csv index 50e03f2c2f..a26d6aaba1 100644 --- a/lookups/splunk_risky_command_20240601.csv +++ b/lookups/splunk_risky_command_20240722.csv @@ -1,16 +1,16 @@ -"splunk_risky_command","description","vulnerable_versions","CVE","other_metadata" -"*createrss*","createrss command overwrites existing RSS feeds without verifying permissions","8.1.13, 8.2.10","CVE-2023-22931", -"*pivot?seedSid=*","pivot command allows a search to bypass SPL safeguards for risky commands using a saved job","8.1.13, 8.2.10, 9.0.4","CVE-2023-22934", -"*|makeresults+&search_listener*","search_listener parameter in a Search allows for a Blind Server Side Request Forgery by an authenticated user","8.1.13, 8.2.10, 9.0.4","CVE-2023-22936", -"*| map search=*| *","map search processing language (SPL) command lets a search bypass SPL safeguards for risky commands","8.1.13, 8.2.10, 9.0.4","CVE-2023-22939", -"*|mcollect%20index*","collect command SPL aliases commands could potentially allow for the exposing of data to a summary index that unprivileged users could access","8.1.13, 8.2.10, 9.0.4","CVE-2023-22940", -"*|""*meventcollect*""","collect command SPL alias could potentially allow for the exposing of data to a summary index that unprivileged users could access","8.1.13, 8.2.10, 9.0.4","CVE-2023-22940", -"*|""*summaryindex*""","collect command SPL alias could potentially allow for the exposing of data to a summary index that unprivileged users could access","8.1.13, 8.2.10, 9.0.4","CVE-2023-22940", -"*|""*sumindex*""","collect command SPL alias could potentially allow for the exposing of data to a summary index that unprivileged users could access","8.1.13, 8.2.10, 9.0.4","CVE-2023-22940", -"*|""*stash*""","collect command SPL alias could potentially allow for the exposing of data to a summary index that unprivileged users could access","8.1.13, 8.2.10, 9.0.4","CVE-2023-22940", -"*| sendalert *","display.page.search.patterns.sensitivity search parameter allows a search to bypass SPL safeguards for risky commands using obfuscation","8.1.13, 8.2.10, 9.0.4","CVE-2023-22935", +"splunk_risky_command","description","vulnerable_versions","CVE" +"*createrss*","createrss command overwrites existing RSS feeds without verifying permissions","8.1.13, 8.2.10","CVE-2023-22931" +"*pivot?seedSid=*","pivot command allows a search to bypass SPL safeguards for risky commands using a saved job","8.1.13, 8.2.10, 9.0.4","CVE-2023-22934" +"*|makeresults+&search_listener*","search_listener parameter in a Search allows for a Blind Server Side Request Forgery by an authenticated user","8.1.13, 8.2.10, 9.0.4","CVE-2023-22936" +"*| map search=*| *","map search processing language (SPL) command lets a search bypass SPL safeguards for risky commands","8.1.13, 8.2.10, 9.0.4","CVE-2023-22939" +"*|mcollect%20index*","collect command SPL aliases commands could potentially allow for the exposing of data to a summary index that unprivileged users could access","8.1.13, 8.2.10, 9.0.4","CVE-2023-22940" +"*|""*meventcollect*""","collect command SPL alias could potentially allow for the exposing of data to a summary index that unprivileged users could access","8.1.13, 8.2.10, 9.0.4","CVE-2023-22940" +"*|""*summaryindex*""","collect command SPL alias could potentially allow for the exposing of data to a summary index that unprivileged users could access","8.1.13, 8.2.10, 9.0.4","CVE-2023-22940" +"*|""*sumindex*""","collect command SPL alias could potentially allow for the exposing of data to a summary index that unprivileged users could access","8.1.13, 8.2.10, 9.0.4","CVE-2023-22940" +"*|""*stash*""","collect command SPL alias could potentially allow for the exposing of data to a summary index that unprivileged users could access","8.1.13, 8.2.10, 9.0.4","CVE-2023-22940" +"*| sendalert *","display.page.search.patterns.sensitivity search parameter allows a search to bypass SPL safeguards for risky commands using obfuscation","8.1.13, 8.2.10, 9.0.4","CVE-2023-22935" "*|*runshellscript*","runshellscript searches should not be run interactively via User Interface or REST API and may be used to bypass safeguards; runshellscript may be abused to exploit legacy internal functions in external lookups leading to arbitrary code execution","<8.1.14, <8.2.12, <9.0.6, <9.1.1; -<8.2.12, <9.0.6, <9.1.1","CVE-2023-40598, CVE-2023-46214", -"*|*mrollup*","The “mrollup” SPL command lets a low-privileged user view metrics on an index that they do not have permission to view. This vulnerability requires user interaction from a high-privileged user to exploit.","<9.0.8, <9.1.3, <9.1.2308.200","CVE-2024-23676", -"*|*mstats*", "The "mstats" SPL command lets malicious user can control a search query in Analytics Workspace using params from another search (via job SID) and quotation mark ' ' and " incorrect handling", "<9.0.10, <9.1.5, <9.2.2","CVE-2024-36984" \ No newline at end of file +<8.2.12, <9.0.6, <9.1.1","CVE-2023-40598, CVE-2023-46214" +"*|*mrollup*","The “mrollup” SPL command lets a low-privileged user view metrics on an index that they do not have permission to view. This vulnerability requires user interaction from a high-privileged user to exploit.","<9.0.8, <9.1.3, <9.1.2308.200","CVE-2024-23676" +"*|*mstats*","The ""mstats"" SPL command lets malicious user can control a search query in Analytics Workspace using params from another search (via job SID) and quotation mark ' ' and "" incorrect handling","<9.0.10, <9.1.5, <9.2.2","CVE-2024-36984" \ No newline at end of file