Splunk Enterprise 8.0.5 I have a local 'splunk' user account that has all permissions (chown and chgrp) that is running Splunk. The problem is that the vulnerability conditions are satisfied with this configuration. 1. Is met with Splunk being run as non-root user 'splunk' 2. Is met because in order to run splunk, the user has to have permissions to the dirs. 3a. Is met when Splunk is set to run at boot as specified user. 3b. Is met because the splunk user has to be set in splunk-launch.conf. I don't see a way out of this with the recommended mitigation configuration. ### vuln info from https://www.splunk.com/view/SP-CAAAP3M Potential Local Privilege Escalation through instructions to run Splunk as non-root user (SPL-144192) Description: Specific configurations that have Splunk Enterprise, Splunk Light, or a Splunk Universal Forwarder running as non-root that match all the following characteristics: 1. Splunk Enterprise, Splunk Light, or the Universal Forwarder are running as non-root user. 2. $SPLUNK_HOME and $SPLUNK_HOME/etc both are owned by the running splunk user. 3. Satisfied one of the following conditions a. A Splunk init script created via $SPLUNK_HOME/bin/splunk enable boot-start –user <user> on Splunk 6.1.x or later. b. A line with SPLUNK_OS_USER=<user> exists in $SPLUNK_HOME/etc/splunk-launch.conf The above specific configurations of Splunk Enterprise, Splunk Light and Universal Forwarders, are vulnerable to the Splunk Administrator being able to induce code execution as root.
... View more