mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
pyth0n1c
51 lines
1.8 KiB
YAML
51 lines
1.8 KiB
YAML
name: Splunk DOS via printf search function
|
|
id: 78b48d08-075c-4eac-bd07-e364c3780867
|
|
version: 1
|
|
date: '2023-08-30'
|
|
author: Rod Soto, Eric McGinnis, Splunk
|
|
status: production
|
|
type: Hunting
|
|
data_source: []
|
|
description: This hunting search provides information on detecting a vulnerability In Splunk Enterprise versions lower than 8.1.14, 8.2.12, 9.0.6, and 9.1.1, an attacker can use the printf SPL function to perform a denial of service against the Splunk Enterprise instance.
|
|
search: '`audit_searches` "*makeresults * eval * fieldformat *printf*" user!="splunk_system_user" search!="*audit_searches*"
|
|
| stats count by user splunk_server host search
|
|
| convert ctime(*time) |`splunk_dos_via_printf_search_function_filter`'
|
|
how_to_implement: This search requires the ability to search internal indexes.
|
|
known_false_positives: This search may produces false positives, analyst most focuse in the use of printf conversion function of eval to craft an expression that splunkd cannot interpret correctly causing it to crash.
|
|
references:
|
|
- https://advisory.splunk.com/
|
|
tags:
|
|
analytic_story:
|
|
- Splunk Vulnerabilities
|
|
asset_type: endpoint
|
|
confidence: 100
|
|
impact: 100
|
|
message: Possible denial of service attack against $host$
|
|
cve:
|
|
- CVE-2023-40594
|
|
mitre_attack_id:
|
|
- T1499.004
|
|
observable:
|
|
- name: host
|
|
type: Hostname
|
|
role:
|
|
- Victim
|
|
product:
|
|
- Splunk Enterprise
|
|
- Splunk Enterprise Security
|
|
- Splunk Cloud
|
|
risk_score: 100
|
|
required_fields:
|
|
- user
|
|
- splunk_server
|
|
- host
|
|
- search
|
|
security_domain: endpoint
|
|
tests:
|
|
- name: True Positive Test
|
|
attack_data:
|
|
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1499.004/splunk/splunk_printf_abuse.log
|
|
source: audittrail
|
|
sourcetype: audittrail
|
|
custom_index: _audit
|