Description:

CVE-2024-29945 is a vulnerability in Splunk Enterprise versions below 9.2.1, 9.1.4, and 9.0.9. It allows for the potential exposure of authentication tokens during the token validation process when Splunk Enterprise runs in debug mode or the JsonWebToken component is configured to log its activity at the DEBUG logging level. The SVRS for this CVE is 30, indicating a moderate level of risk.

Key Insights:

• Authentication Token Exposure: This vulnerability could allow attackers to obtain authentication tokens, which could be used to gain unauthorized access to Splunk Enterprise.
• Debug Mode and Logging Level: The vulnerability is only exploitable when Splunk Enterprise is running in debug mode or when the JsonWebToken component is configured to log its activity at the DEBUG logging level.
• Active Exploitation: This vulnerability is actively exploited in the wild, meaning that attackers are actively using it to target systems.

Mitigation Strategies:

• Update Splunk Enterprise: Update Splunk Enterprise to version 9.2.1, 9.1.4, or 9.0.9 to address this vulnerability.
• Disable Debug Mode: Disable debug mode in Splunk Enterprise to reduce the risk of exploitation.
• Configure Logging Level: Configure the JsonWebToken component to log its activity at a level other than DEBUG to reduce the risk of exposure.
• Monitor for Suspicious Activity: Monitor Splunk Enterprise for any suspicious activity that could indicate an attack.

Additional Information:

• Threat Actors/APT Groups: No specific threat actors or APT groups have been identified as actively exploiting this vulnerability.
• Exploit Status: Active exploits have been published for this vulnerability.
• CISA Warnings: The Cybersecurity and Infrastructure Security Agency (CISA) has warned of this vulnerability, calling for immediate and necessary measures.

If users have additional queries regarding this incident, they can use the 'Ask to Analyst' feature, contact SOCRadar directly, or open a support ticket for more information if necessary.