A high-severity Server Side Request Forgery vulnerability in Splunk Enterprise and Splunk Secure Gateway allows authenticated attackers to potentially access internal network resources.

This vulnerability is a Server Side Request Forgery (SSRF) flaw, classified under CWE-918, where the application fails to adequately validate the destination of outbound requests. The vulnerability requires the attacker to have low-level authentication to the system.

Successful exploitation allows an attacker to bypass network segmentation and interact with internal services that are not exposed to the public internet. Given the CVSS score of 8.8, this poses a significant risk of data exfiltration or internal reconnaissance, potentially facilitating further lateral movement within the corporate network.

Immediate Action: Upgrade Splunk Enterprise to versions 10.4.2, 10.2.6, 10.0.9, 9.4.14, or higher, and ensure Splunk Secure Gateway is updated to the corresponding patched versions provided in the vendor advisory.

Proactive Monitoring: Review web server and access logs for unusual outbound connection patterns or requests directed at internal IP addresses or sensitive local services.

Compensating Controls: Deploy a Web Application Firewall (WAF) or egress filtering rules to restrict the server from initiating connections to unauthorized internal network segments.

Public Exploit Available: unknown

Organizations should prioritize patching affected Splunk instances immediately. Given the potential for internal network exposure, verify that all Splunk components are included in the update cycle to eliminate the risk of exploitation by authenticated malicious actors.