From b183d7f9188fc26ad277c5656963e46d0a25e01a Mon Sep 17 00:00:00 2001 From: Nikhil sai Date: Sat, 15 Aug 2026 16:39:10 +0530 Subject: [PATCH 1/5] Add vulnerability detection module for CVE-2026-20253 (Splunk unauthenticated auth-bypass) --- .../modules/vuln/splunk_cve_2026_20253.yaml | 77 +++++++++++++++++++ 1 file changed, 77 insertions(+) create mode 100644 nettacker/modules/vuln/splunk_cve_2026_20253.yaml diff --git a/nettacker/modules/vuln/splunk_cve_2026_20253.yaml b/nettacker/modules/vuln/splunk_cve_2026_20253.yaml new file mode 100644 index 000000000..62588ca5a --- /dev/null +++ b/nettacker/modules/vuln/splunk_cve_2026_20253.yaml @@ -0,0 +1,77 @@ +info: + name: splunk_cve_2026_20253_vuln + author: NSK-394 + severity: 9.8 + description: > + CVE-2026-20253 (CVSS 9.8, CISA KEV) is a missing-authentication flaw + (CWE-306) in Splunk Enterprise's bundled PostgreSQL sidecar service, + reachable through an unauthenticated raw-passthrough proxy path on + Splunk Web (default port 8000). Splunk Enterprise 10.0.0-10.0.6 and + 10.2.0-10.2.3 accept POST /en-US/splunkd/__raw/v1/postgres/recovery/backup + with ANY syntactically-valid HTTP Basic Authorization header -- including + a blank ":" credential or entirely fabricated ones -- because the + credential value itself is never checked; the request succeeds (200, + a "BackupPending" job is created) exactly as it would for a genuine + admin. Patched versions (10.0.7, 10.2.4, 10.4.0+) reject the identical + request with 401 "Authorization header must use Splunk token", having + dropped Basic-auth support on this endpoint entirely. This module + detects that unauthenticated auth-bypass primitive -- the CVE's actual + root cause -- by sending a single non-destructive POST with a blank + Basic header and checking for the resulting BackupPending response. + Behavior was confirmed live against the official splunk/splunk:10.0.6 + (vulnerable) and splunk/splunk:10.0.7 (patched) Docker images. This + module does NOT attempt or verify the full RCE chain some public + writeups describe: that chain additionally requires standing up an + attacker-controlled external PostgreSQL server to inject a malicious + connection string via this same endpoint, then waiting on Splunk's own + task scheduler to execute a file planted through a lo_export-based + restore. This module confirms the input-validation/auth flaw that + chain depends on, not code execution itself. + reference: + - https://nvd.nist.gov/vuln/detail/CVE-2026-20253 + - https://advisory.splunk.com/advisories/SVD-2026-0603 + - https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20253 + profiles: + - vuln + - http + - critical_severity + - cve + - cve2026 + - splunk + - cisa_kev + - auth_bypass + +payloads: + - library: http + steps: + - method: post + timeout: 5 + headers: + User-Agent: Nettacker + Content-Type: application/json + Authorization: "Basic Og==" + ssl: false + data: '{{"database": "postgres", "backupFile": "nettacker_check"}}' + url: + nettacker_fuzzer: + input_format: "{{schema}}://{target}:{{ports}}/en-US/splunkd/__raw/v1/postgres/recovery/backup" + prefix: "" + suffix: "" + interceptors: + data: + schema: + - "http" + - "https" + ports: + - 8000 # Default Splunk Web port + - 80 + - 443 + response: + condition_type: and + conditions: + status_code: + regex: "200" + reverse: false + content: + regex: '"state":"BackupPending"' + reverse: false From a59df3dbec769ef5e87c288e100c85dc043e68c2 Mon Sep 17 00:00:00 2001 From: Nikhil sai Date: Sat, 15 Aug 2026 16:44:39 +0530 Subject: [PATCH 2/5] Add docs/Modules.md entry for splunk_cve_2026_20253_vuln module --- docs/Modules.md | 1 + 1 file changed, 1 insertion(+) diff --git a/docs/Modules.md b/docs/Modules.md index 96844ab3d..9532c262b 100644 --- a/docs/Modules.md +++ b/docs/Modules.md @@ -238,6 +238,7 @@ If you want to scan all ports please define -g 1-65535 range. Otherwise Nettacke - '**qsan_storage_xss_cve_2021_37216_vuln**' – check the target for QSAN CVE-2021-37216 XSS vulnerability - '**server_version_vuln**' – check if the web server is leaking server banner in 'Server' response header - '**sonicwall_sslvpn_cve_2024_53704_vuln**' – check the target for SonicWall SSLVPN CVE-2024-53704 vulnerability +- '**splunk_cve_2026_20253_vuln**' – check the target for Splunk Enterprise CVE-2026-20253 unauthenticated auth-bypass vulnerability - '**ssl_certificate_weak_signature_vuln**' – check SSL certificate for weak signing algorithms - '**ssl_expired_certificate_vuln**' – check if SSL certificate has expired or is close to expiring - '**ssl_self_signed_certificate_vuln**' – check for self-signed SSL certificates From d591b7cf7e9715be597dc42963f9f1e959d06794 Mon Sep 17 00:00:00 2001 From: Nikhil sai Date: Sun, 16 Aug 2026 04:19:16 +0530 Subject: [PATCH 3/5] Fix module to be genuinely non-destructive: detect auth-bypass via malformed-request validation error instead of creating a real backup job Previous version's success condition (status 200 + BackupPending) proved a real backup job was created on the vulnerable target on every scan, contradicting the module's own non-destructive claim (caught by Codex review). Fixed by omitting the backupFile field entirely -- vulnerable instances bypass auth and reach field validation (400 + specific error message), while patched instances reject on auth before ever reaching validation (401), regardless of body content. Verified stable across 8 repeated attempts on the vulnerable side and 8 attempts (including 3 additional malformed-variant checks) on the patched side, with zero job creation confirmed in both cases. --- .../modules/vuln/splunk_cve_2026_20253.yaml | 48 +++++++++++-------- 1 file changed, 28 insertions(+), 20 deletions(-) diff --git a/nettacker/modules/vuln/splunk_cve_2026_20253.yaml b/nettacker/modules/vuln/splunk_cve_2026_20253.yaml index 62588ca5a..cdefdf60f 100644 --- a/nettacker/modules/vuln/splunk_cve_2026_20253.yaml +++ b/nettacker/modules/vuln/splunk_cve_2026_20253.yaml @@ -10,23 +10,31 @@ info: 10.2.0-10.2.3 accept POST /en-US/splunkd/__raw/v1/postgres/recovery/backup with ANY syntactically-valid HTTP Basic Authorization header -- including a blank ":" credential or entirely fabricated ones -- because the - credential value itself is never checked; the request succeeds (200, - a "BackupPending" job is created) exactly as it would for a genuine - admin. Patched versions (10.0.7, 10.2.4, 10.4.0+) reject the identical - request with 401 "Authorization header must use Splunk token", having - dropped Basic-auth support on this endpoint entirely. This module - detects that unauthenticated auth-bypass primitive -- the CVE's actual - root cause -- by sending a single non-destructive POST with a blank - Basic header and checking for the resulting BackupPending response. - Behavior was confirmed live against the official splunk/splunk:10.0.6 - (vulnerable) and splunk/splunk:10.0.7 (patched) Docker images. This - module does NOT attempt or verify the full RCE chain some public - writeups describe: that chain additionally requires standing up an - attacker-controlled external PostgreSQL server to inject a malicious - connection string via this same endpoint, then waiting on Splunk's own - task scheduler to execute a file planted through a lo_export-based - restore. This module confirms the input-validation/auth flaw that - chain depends on, not code execution itself. + credential value itself is never checked and the request is allowed to + proceed past authentication. Patched versions (10.0.7, 10.2.4, 10.4.0+) + reject the identical request with 401 "Authorization header must use + Splunk token" before ever inspecting the body, having dropped Basic-auth + support on this endpoint entirely. This module detects that + unauthenticated auth-bypass primitive -- the CVE's actual root cause -- + non-destructively: it sends a blank-Basic-auth POST whose JSON body + deliberately omits the required "backupFile" field. On vulnerable + instances, auth is bypassed first and the request then fails input + validation with 400 "backupFile is a required field" -- no backup job + is ever created. On patched instances, the same request is rejected at + the auth layer with 401 before validation runs. An earlier version of + this module distinguished the two by checking for a real 200 response + with a "BackupPending" job-creation body; that was corrected after + review because it meant every scan created a real, tracked backup job + on the target, contradicting a non-destructive design. Both the old and + new signatures were confirmed live and repeatable against the official + splunk/splunk:10.0.6 (vulnerable) and splunk/splunk:10.0.7 (patched) + Docker images. This module does NOT attempt or verify the full RCE + chain some public writeups describe: that chain additionally requires + standing up an attacker-controlled external PostgreSQL server to inject + a malicious connection string via this same endpoint, then waiting on + Splunk's own task scheduler to execute a file planted through a + lo_export-based restore. This module confirms the input-validation/auth + flaw that chain depends on, not code execution itself. reference: - https://nvd.nist.gov/vuln/detail/CVE-2026-20253 - https://advisory.splunk.com/advisories/SVD-2026-0603 @@ -51,7 +59,7 @@ payloads: Content-Type: application/json Authorization: "Basic Og==" ssl: false - data: '{{"database": "postgres", "backupFile": "nettacker_check"}}' + data: '{{"database": "postgres"}}' url: nettacker_fuzzer: input_format: "{{schema}}://{target}:{{ports}}/en-US/splunkd/__raw/v1/postgres/recovery/backup" @@ -70,8 +78,8 @@ payloads: condition_type: and conditions: status_code: - regex: "200" + regex: "400" reverse: false content: - regex: '"state":"BackupPending"' + regex: "backupFile is a required field" reverse: false From e67b829988c3603354829e7c07f0091d276d7bfe Mon Sep 17 00:00:00 2001 From: Nikhil sai Date: Sun, 16 Aug 2026 04:56:58 +0530 Subject: [PATCH 4/5] Use {user_agent} placeholder instead of hardcoded User-Agent value --- nettacker/modules/vuln/splunk_cve_2026_20253.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nettacker/modules/vuln/splunk_cve_2026_20253.yaml b/nettacker/modules/vuln/splunk_cve_2026_20253.yaml index cdefdf60f..f3296605d 100644 --- a/nettacker/modules/vuln/splunk_cve_2026_20253.yaml +++ b/nettacker/modules/vuln/splunk_cve_2026_20253.yaml @@ -55,7 +55,7 @@ payloads: - method: post timeout: 5 headers: - User-Agent: Nettacker + User-Agent: {user_agent} Content-Type: application/json Authorization: "Basic Og==" ssl: false From 194e327e38e106f1fa44e8da0a2ba589b67c8e54 Mon Sep 17 00:00:00 2001 From: Nikhil sai Date: Sun, 16 Aug 2026 05:25:50 +0530 Subject: [PATCH 5/5] Add quotes around {user_agent} placeholder for consistency with existing modules --- nettacker/modules/vuln/splunk_cve_2026_20253.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nettacker/modules/vuln/splunk_cve_2026_20253.yaml b/nettacker/modules/vuln/splunk_cve_2026_20253.yaml index f3296605d..79883401e 100644 --- a/nettacker/modules/vuln/splunk_cve_2026_20253.yaml +++ b/nettacker/modules/vuln/splunk_cve_2026_20253.yaml @@ -55,7 +55,7 @@ payloads: - method: post timeout: 5 headers: - User-Agent: {user_agent} + User-Agent: "{user_agent}" Content-Type: application/json Authorization: "Basic Og==" ssl: false