Vulnerabilities
Splunk Classic Dashboards Vulnerability Enables Data Exfiltration via Protocol-Relative URLs
A flaw in Splunk Enterprise and Cloud Platform classic dashboards allows low‑privileged users to redirect victims to external sites using protocol‑relative URLs, bypassing the external‑navigation warning. Affected versions include all releases prior to 10.2.4, 10.0.7, 9.4.12, 9.3.13 (Enterprise) and 10.3.2512.13, 10.2.2510.15, 10.1.2507.23, 9.3.2411.132 (Cloud). Defenders should upgrade, restrict dashboard access, or adjust URL validation.
What Happened
Splunk’s classic dashboards contain a flaw where the URL classifier only checks for http:// and https:// schemes. A low‑privileged user can embed a protocol‑relative URL (e.g., //attacker.com) in a drill‑down link, causing the victim’s browser to navigate to an attacker‑controlled site without triggering the external‑navigation warning dialog.
Impact
Users with any role other than admin or power can exploit this to exfiltrate data or deliver phishing content. The vulnerability is classified as low severity but can be leveraged for credential theft or lateral movement if the victim interacts with the malicious link.
Mitigation
- Upgrade to Splunk Enterprise 10.2.4 or newer, 10.0.7 or newer, 9.4.12 or newer, 9.3.13 or newer.
- Upgrade Splunk Cloud Platform to 10.3.2512.13 or newer, 10.2.2510.15 or newer, 10.1.2507.23 or newer, 9.3.2411.132 or newer.
- Restrict dashboard access to
adminorpowerroles. - Disable classic dashboards if not required.
- Configure the URL classifier to reject protocol‑relative URLs.
Recommendations for Defenders
Audit dashboard configurations for drill‑down links, enforce role‑based access controls, and monitor for unexpected external navigation events. Apply the latest security patches promptly and validate that the external‑navigation warning dialog appears for all external URLs.
Related vulnerabilities
Splunk Classic Dashboard Vulnerability Enables Data Exfiltration by Low‑Privilege Users
A flaw in Splunk’s classic dashboard external content dialog lets non‑admin users craft dashboards that send data to arbitrary external domains. The issue affects multiple Enterprise and Cloud Platform releases and can lead to data leakage. Defenders should upgrade or restrict dashboard creation.
Read briefing
Splunk Classic Dashboard CSS Vulnerability Enables Data Exfiltration by Low-Privileged Users
Splunk Enterprise and Cloud Platform versions prior to 10.2.4, 10.0.7, 9.4.12, 9.3.13 (Enterprise) and 10.3.2512.13, 10.2.2510.15, 10.1.2507.23, 9.3.2411.132 (Cloud) allow a low‑privileged user to craft a classic dashboard that exfiltrates data from higher‑privileged users’ browsers via external requests. The flaw requires phishing to trigger the victim’s browser. Defenders should patch to the specified versions and restrict dashboard creation permissions.
Read briefing
Splunk Classic Dashboard XSS Allows Low‑Privilege User to Inject JavaScript
A stored XSS flaw in Splunk classic dashboards lets a non‑admin user embed malicious script that runs in another user's browser when the dashboard is opened. The issue exists in pre‑10.2.4, pre‑10.0.7, pre‑9.4.12, and pre‑9.3.13 Enterprise releases and corresponding Cloud Platform versions. Defenders should patch immediately or disable HTML panels.
Read briefing
Splunk AI Toolkit 5.7.4 Vulnerability: Insecure Default Domain Allowlist Enables Low‑Privileged Data Exfiltration
A flaw in Splunk AI Toolkit versions below 5.7.4 allows low‑privileged users to trigger outbound HTTP requests to attacker‑controlled domains, potentially leaking data. The issue stems from an unrestricted default allowlist. Defenders should upgrade to 5.7.4 or configure explicit domain restrictions.
Read briefing