CVE-2011-4642

Related Files

Splunk Search Remote Code Execution

Posted Dec 23, 2011

Authored by Gary O'Leary-Steele, juan vazquez | Site metasploit.com

This Metasploit module abuses a command execution vulnerability within the web based interface of Splunk 4.2 to 4.2.4. The vulnerability exists within the 'mappy' search command which allows to run python code. To exploit this vulnerability a valid Splunk user with the admin role is required. Unfortunately, Splunk uses a default credential of 'admin:changeme' for admin access, which is used to leverage our attack. The Splunk Web interface runs as SYSTEM on Windows and as root on Linux by default.

tags | exploit, web, root, python

systems | linux, windows

advisories | CVE-2011-4642, OSVDB-77695

SHA-256 | 4cec15e9c8252677e5cd1bb453f1bd43e0c2eb409d8162a5ce458bb290116509

Download | Favorite | View

Splunk Remote Root Command Execution / Directory Traversal

Posted Dec 15, 2011

Authored by Gary O'Leary-Steele | Site sec-1.com

Sec-1 Labs performed a product security analysis of Splunk and discovered remote command execution as a privileged user, a directory traversal vulnerability, failure to protect itself from brute force attacks and information disclosure issues. Versions 4.2.2, 4.2.3 and 4.2.4 were tested. This archive contains an advisory and an exploit.

tags | exploit, remote, info disclosure

systems | linux

advisories | CVE-2011-4642, CVE-2011-4643, CVE-2011-4644

SHA-256 | 9cc7b90d467527ef440024994f447af75a7361359080cde790f375729dc79e38

Download | Favorite | View