Splunk Classic Dashboard Vulnerability Enables Data Exfiltration by Low‑Privilege Users

What happened

In Splunk Enterprise and Splunk Cloud Platform, a flaw in the classic dashboard external content dialog allows a non‑admin, non‑power user to craft a dashboard that sends data to an arbitrary external domain. The issue stems from incomplete URL validation, enabling the dashboard to bypass the sandbox and exfiltrate sensitive information.

Impact

Low‑privilege users can exfiltrate any data visible in the dashboard, including logs, metrics, and configuration details, to a malicious server. This can lead to data leakage, regulatory violations, and further compromise of the Splunk instance.

Affected Versions

• Splunk Enterprise: < 10.2.4, 10.0.7, 9.4.12, 9.3.13
• Splunk Cloud Platform: < 10.3.2512.13, 10.2.2510.15, 10.1.2507.23, 9.3.2411.132

Mitigation

Upgrade to the latest patched releases (Enterprise 10.2.4 or later, 10.0.7 or later, 9.4.12 or later, 9.3.13 or later; Cloud 10.3.2512.13 or later, 10.2.2510.15 or later, 10.1.2507.23 or later, 9.3.2411.132 or later). If an upgrade is not immediately possible, restrict dashboard creation to admin or power roles and disable external content dialogs for all users.