Splunk Enterprise (versions 10.0.6 and below, 10.2.3 and below)
Splunk is a platform used by IT and security teams to collect, search, and analyse machine-generated data — logs, alerts, and system events — across an organisation's infrastructure.
Root Cause
The PostgreSQL sidecar service exposes backup and restore endpoints that were never protected with authentication controls. Any network-reachable user can call these endpoints directly. The developer failed to restrict access to what are effectively administrative database functions — functions capable of reading, writing, and executing content on the underlying file system.
Attack Vector
An attacker connects their own controlled database to Splunk's exposed backup endpoint and dumps its contents onto the Splunk file system. They then use the restore endpoint to load that dump into Splunk's local PostgreSQL instance, triggering execution of SQL (database query language) commands they wrote themselves. From there, they overwrite a Python script that Splunk runs regularly — injecting whatever code they want the server to execute. No login required at any point in this chain.
Detection Notes
- Look for unexpected connections to Splunk's internal PostgreSQL ports from external or unusual IP addresses.
- Monitor for new or modified Python scripts under
/opt/splunk/etc/apps/— changes outside of normal update windows are a red flag. - Check backup and restore endpoint logs for calls that did not originate from your own admin team.
Recommended Actions
- Upgrade to Splunk Enterprise 10.0.7 or 10.2.4 immediately.
- If patching is not immediately possible, restrict network access to the PostgreSQL sidecar service ports at the firewall level.
- Audit recent file changes on your Splunk host for any signs of unauthorised writes.