CVE-2013-6771
Splunk runshellscript echo.sh Remote Code Execution Vulnerability
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
Directory traversal vulnerability in the collect script in Splunk before 5.0.5 allows remote attackers to execute arbitrary commands via a .. (dot dot) in the file parameter. NOTE: this issue was SPLIT per ADT2 due to different vulnerability types. CVE-2013-7394 is for the issue in the "runshellscript echo.sh" script.
Vulnerabilidad de salto de directorio en la secuencia de comandos collect en Splunk anterior a 5.0.5 permite a atacantes remotos ejecutar comandos arbitrarios a través de un .. (punto punto) en el parámetro file. NOTA: este problema fue dividido (SPLIT) por ADT2 debido a tipos de vulnerabilidad diferentes. CVE-2013-7394 es para el problema en la secuencia de comandos 'runshellscript echo.sh'.
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Splunk. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the advanced search functionality. Using a multi-staged attack, it is possible to execute arbitrary commands on the underlying operating system by sending a malformed string to the "runshellscript echo.sh" script. This vulnerability allows an attacker to execute code under the context of the process.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2013-11-10 CVE Reserved
- 2014-04-03 CVE Published
- 2024-06-19 EPSS Updated
- 2024-08-06 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CAPEC
References (2)
| URL | Tag | Source |
|---|---|---|
| http://zerodayinitiative.com/advisories/ZDI-14-052 | X_refsource_misc |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| http://www.splunk.com/view/SP-CAAAH76 | 2014-08-07 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Splunk Search vendor "Splunk" | Splunk Search vendor "Splunk" for product "Splunk" | <= 5.0.4 Search vendor "Splunk" for product "Splunk" and version " <= 5.0.4" | - |
Affected
| ||||||
| Splunk Search vendor "Splunk" | Splunk Search vendor "Splunk" for product "Splunk" | 5.0 Search vendor "Splunk" for product "Splunk" and version "5.0" | - |
Affected
| ||||||
| Splunk Search vendor "Splunk" | Splunk Search vendor "Splunk" for product "Splunk" | 5.0.1 Search vendor "Splunk" for product "Splunk" and version "5.0.1" | - |
Affected
| ||||||
| Splunk Search vendor "Splunk" | Splunk Search vendor "Splunk" for product "Splunk" | 5.0.2 Search vendor "Splunk" for product "Splunk" and version "5.0.2" | - |
Affected
| ||||||
| Splunk Search vendor "Splunk" | Splunk Search vendor "Splunk" for product "Splunk" | 5.0.3 Search vendor "Splunk" for product "Splunk" and version "5.0.3" | - |
Affected
| ||||||