[New post] Exploiting Splunk SOAR Vulnerability To Hack Into Secure Network

Malware Devil posted: "Splunk has found a vulnerability that enables unauthenticated log injection, which opens the door for hostile actors to execute dangerous code on the system. This flaw was identified by Splunk.Splunk SOAR, which stands for Security Orchestration, Automati" Malware Devil Exploiting Splunk SOAR Vulnerability To Hack Into Secure Network Malware Devil Aug 1 Splunk has found a vulnerability that enables unauthenticated log injection, which opens the door for hostile actors to execute dangerous code on the system. This flaw was identified by Splunk.Splunk SOAR, which stands for Security Orchestration, Automation, and Response, is a program that can be used to automate repetitive operations and react quickly to security issues. This ultimately results in improved levels of productivity. Playbooks may be used to automate answers, and the whole process can be managed via a single interface.There is a security flaw in the Splunk SOAR, which also calls for a terminal program that is able to translate ANSI escape codes. Additionally, in order to exploit this vulnerability, the terminal in question has to have the necessary permissions. Unauthenticated Log Injection in Splunk SOAR, which is identified by the CVE ID 2023-3997 This vulnerability may be exploited by a threat actor by having them make a malicious HTTP request to an endpoint located inside the SOAR. When a terminal user makes an attempt to access the tainted logs, it causes a piece of malicious code to be executed inside the system. This vulnerability has been assigned a CVSS score of 8.6, which is considered to be "High." However, the severity of this vulnerability is determined on the rights granted to the terminal users that try to access the log file. If the malicious log file is copied and viewed on a local system, then that machine, rather than the instance, will be impacted by the vulnerability. Fan of Splunk SIEM? You should be worried as it can now be exploited to leak your company data Splunk has addressed this issue by publishing a security warning on their website. The advice contains a variety of details, including the attack vector, the complexity, the privileges, the scope, and the user engagement. Users of Splunk SOAR are encouraged to update to the most recent versions in order to protect themselves from malicious actors who may try to take advantage of this vulnerability. The post Exploiting Splunk SOAR vulnerability to hack into secure network appeared first on Cyber Security News | Exploit One | Hacking News. Comment Unsubscribe to no longer receive posts from Malware Devil. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://devi.ly/exploiting-splunk-soar-vulnerability-to-hack-into-secure-network/

Get the Jetpack app to use Reader anywhere, anytime Follow your favorite sites, save posts to read later, and get real-time notifications for likes and comments. Automattic, Inc. - 60 29th St. #343, San Francisco, CA 94110