CVE-2023-4571: splunk it_service_intelligence Improper Output Neutralization for Logs

Vulnerability summary

CVE-2023-4571 is a high (CVSS 8.6) Improper Output Neutralization for Logs vulnerability in splunk it_service_intelligence. EPSS estimates a 0.25% chance of exploitation in the next 30 days, higher than 15.6% of scored vulnerabilities.

Timeline

1. 30-08-2023
   PublishedVulnerability first disclosed.
2. 28-02-2025
   Last modifiedVulnerability information updated.

Description

In Splunk IT Service Intelligence (ITSI) versions below below 4.13.3, 4.15.3, or 4.17.1, a malicious actor can inject American National Standards Institute (ANSI) escape codes into Splunk ITSI log files that, when a vulnerable terminal application reads them, can run malicious code in the vulnerable application. This attack requires a user to use a terminal application that translates ANSI escape codes to read the malicious log file locally in the vulnerable terminal. The vulnerability also requires additional user interaction to succeed. The vulnerability does not directly affect Splunk ITSI. The indirect impact on Splunk ITSI can vary significantly depending on the permissions in the vulnerable terminal application, as well as where and how the user reads the malicious log file. For example, users can copy the malicious file from Splunk ITSI and read it on their local machine.

• CWE-117Improper Output Neutralization for LogsThe product constructs a log message from external input, but it does not neutralize or incorrectly neutralizes special elements when the message is written to a log file.
• CWE-116Improper Encoding or Escaping of OutputThe product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.