Exploitation Attempt Of CVE-2023-46214 Using Public POC Code

Detects exploitation attempt of CVE-2023-46214, a remote code execution (RCE) in Splunk Enterprise through insecure XML parsing using known public proof of concept code

title: Exploitation Attempt Of CVE-2023-46214 Using Public POC Code
id: ba5268de-4dd4-4d5c-8a90-2b5e6dc1aff8
related:
    - id: 04017cd5-621e-4ec4-a762-1f042fe3d3e5
      type: derived
status: test
description: |
    Detects exploitation attempt of CVE-2023-46214, a remote code execution (RCE) in Splunk Enterprise through insecure XML parsing using known public proof of concept code
references:
    - https://github.com/nathan31337/Splunk-RCE-poc/
    - https://blog.hrncirik.net/cve-2023-46214-analysis
    - https://advisory.splunk.com/advisories/SVD-2023-1104
author: Lars B. P. Frydenskov(Trifork Security)
date: 2023-11-27
tags:
    - attack.lateral-movement
    - attack.t1210
    - cve.2023-46214
    - detection.emerging-threats
logsource:
    category: webserver
detection:
    selection_method_and_response:
        cs-method: POST
        sc-status:
            - 200
            - 302
    selection_uri_upload:
        cs-uri-stem|contains: '/splunkd/__upload/indexing/preview'
        cs-uri-query|contains|all:
            - 'NO_BINARY_CHECK=1'
            - 'input.path=shell.xsl'
    selection_uri_search:
        cs-uri-stem|contains|all:
            - '/api/search/jobs'
            - '/results'
        cs-uri-query|contains|all:
            - '/opt/splunk/var/run/splunk/dispatch/'
            - '/shell.xsl'
    condition: selection_method_and_response and 1 of selection_uri_*
falsepositives:
    - Unlikely
level: high

• T1210Exploitation of Remote Services

• https://github.com/nathan31337/Splunk-RCE-poc/↗
• https://blog.hrncirik.net/cve-2023-46214-analysis↗
• https://advisory.splunk.com/advisories/SVD-2023-1104↗