CVE-2023-3997: splunk soar Improper Output Neutralization for Logs

Vulnerability summary

CVE-2023-3997 is a high (CVSS 8.6) Improper Output Neutralization for Logs vulnerability in splunk soar. EPSS estimates a 0.29% chance of exploitation in the next 30 days, higher than 19.8% of scored vulnerabilities.

Timeline

1. 31-07-2023
   PublishedVulnerability first disclosed.
2. 28-02-2025
   Last modifiedVulnerability information updated.

Description

Splunk SOAR versions lower than 6.1.0 are indirectly affected by a potential vulnerability accessed through the user’s terminal. A third party can send Splunk SOAR a maliciously crafted web request containing special ANSI characters to cause log file poisoning. When a terminal user attempts to view the poisoned logs, this can tamper with the terminal and cause possible malicious code execution from the terminal user’s action.

• CWE-117Improper Output Neutralization for LogsThe product constructs a log message from external input, but it does not neutralize or incorrectly neutralizes special elements when the message is written to a log file.
• CWE-116Improper Encoding or Escaping of OutputThe product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.