Splunk released security updates addressing multiple high-severity vulnerabilities in Splunk Enterprise for Windows, led by a remote code execution flaw tracked as CVE-2024-45733 (CVSS 8.8) and an arbitrary file write bug tracked as CVE-2024-45731 (CVSS 8.0). CVE-2024-45733 stems from an insecure session storage configuration in the Splunk Web component, allowing authenticated low-privileged users lacking administrative roles to execute arbitrary code within the Splunk service context. Concurrently, CVE-2024-45731 exploits relative path traversal when Splunk is installed on a non-system drive, allowing unprivileged accounts to write arbitrary files into the Windows system root (C:\Windows\System32).

The flaws affect Splunk Enterprise for Windows versions 9.2.0–9.2.2 and 9.1.0–9.1.5, leaving Unix-based deployments unaffected. Exploitation allows adversaries with low-tier application access to plant malicious DLLs into system directories or execute payloads via session state manipulation, facilitating local privilege escalation to system level. Splunk addressed the issues in versions 9.3.1, 9.2.3, and 9.1.6, urging administrators unable to apply patches immediately to disable the Splunk Web interface on distributed indexers via web.conf to eliminate exposure.

Why it matters:

• Bullet 1 — Technical & Architecture Risk: Low-privileged web access combined with path traversal across drive boundaries circumvents application-tier access controls, allowing unprivileged users to execute code as the service account or drop DLLs into Windows system directories to hijack core OS processes.
• Bullet 2 — Strategic & Defender Imperative: SIEM infrastructure represents a critical hub of enterprise audit telemetry; security teams must upgrade Windows Splunk Enterprise deployments immediately, disable Splunk Web on dedicated indexing nodes via web.conf, and audit system directories for untrusted DLL drops.