A Server-Side Request Forgery vulnerability in the Cisco Talos Intelligence for Enterprise Security Cloud app for Splunk allows attackers to force the server to interact with arbitrary external destinations.

The application fails to properly validate destination URLs when receiving requests from upstream components. This allows an authenticated attacker to perform Server-Side Request Forgery (SSRF), potentially accessing internal network resources or sensitive metadata.

With a CVSS score of 8.8, this vulnerability poses a high risk to organizational security. An attacker could leverage this flaw to bypass network perimeter controls, perform internal scanning, or interact with restricted services that are not exposed to the public internet, leading to data exfiltration or internal service disruption.

Immediate Action: Upgrade the Cisco Talos Intelligence for Enterprise Security Cloud app to version 1.0.3 or later.

Proactive Monitoring: Review Splunk access logs for anomalous requests originating from the plugin that target internal IP addresses or sensitive local services.

Compensating Controls: Ensure that the Splunk server has restrictive egress filtering rules applied at the network level to prevent unauthorized connections to internal resources.

Public Exploit Available: No confirmed public exploit available.

Organizations should treat this high-severity vulnerability with urgency. Applying the vendor-supplied update is the only definitive way to resolve the underlying request validation flaw and prevent potential lateral movement within the environment.