Splunk Classic Dashboard CSS Vulnerability Enables Data Exfiltration by Low-Privileged Users

What happened

Splunk Enterprise and Splunk Cloud Platform versions prior to 10.2.4, 10.0.7, 9.4.12, 9.3.13 (Enterprise) and 10.3.2512.13, 10.2.2510.15, 10.1.2507.23, 9.3.2411.132 (Cloud) contain an input‑validation flaw in classic dashboard panels. The style attribute is not fully sanitized, allowing a low‑privileged user to embed URLs that resolve to domains outside the Trusted Domains List.

Impact

A low‑privileged user can craft a dashboard that, when viewed by a higher‑privileged user, triggers the victim’s browser to send requests to an attacker‑controlled domain. The data sent can include session cookies, authentication tokens, or other sensitive information. The attack requires the victim to click or otherwise load the malicious dashboard, typically via phishing.

“The vulnerability requires the attacker to phish the victim by tricking them into initiating a request within their browser.”

Mitigation

• Upgrade Splunk Enterprise to 10.2.4 or later, 10.0.7 or later, 9.4.12 or later, or 9.3.13 or later.
• Upgrade Splunk Cloud Platform to 10.3.2512.13 or later, 10.2.2510.15 or later, 10.1.2507.23 or later, or 9.3.2411.132 or later.
• Restrict creation of classic dashboards to users with admin or power roles.
• Review Trusted Domains List and enforce strict domain whitelisting.

What to do

Immediately apply the latest security patches, audit existing dashboards for style attributes that reference external domains, and educate users about phishing attempts that might deliver malicious dashboards.