Why Use App-Level Auth When Every Database Has Auth? — Splun...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://labs.watchtowr.com/why-use-app-level-auth-when-every-database-has-auth-splunk-enterprise-cve-2026-20253-pre-auth-rce
• Blog Title: Why Use App-Level Auth When Every Database Has Auth? — Splunk Enterprise CVE-2026-20253 Pre-Auth RCE
• Suggested Section: Network Services Pentesting → 80,443 - Pentesting Web Methodology → Splunk (new product-specific page), cross-linked with Linux Hardening → Software Information → Splunk LPE and Persistence

🎯 Content Summary

Scope and severity. On June 10, 2026, Splunk published an advisory for CVE-2026-20253, a pre-authentication vulnerability in the PostgreSQL Sidecar Service Endpoint. The advisory required no authentication and assigned a CVSS score of 9.8, although it did not explicitly mention remote code execution. Splunk Enterprise is a platform that ingests and indexes logs, metrics, and event data and exposes dashboards, alerts, and Search Processing Language queries. Th...

🔧 Technical Details

Unauthenticated loopback-service exposure: A web application may expose a service bound only to 127.0.0.1 through a raw proxy route. If the proxy fails to enforce application-level authentication, remote users can invoke internal APIs that were assumed to be localhost-only. Forwarding arbitrary Basic-auth usernames to a backend database utility further shifts authentication decisions to the wrong component.

Path traversal through an output filename: Passing an attacker-controlled filename directly to a command such as pg_dump -f without canonicalization or an allowlisted output directory creates an arbitrary file creation and truncation primitive. Traversal such as ../../../../tmp/file escapes the intended directory and writes wherever the service account has permission.

PostgreSQL connection-string injection: If untrusted input reaches a positional PostgreSQL database-name argument...

🤖 Agent Actions

Plan:

1. Map Splunk, web proxy, PostgreSQL, and file-write coverage in the repository.
2. Read at least five relevant pages and compare existing techniques.
3. Verify primary sources needed for precise behavior and citations.
4. Add the material once in the best-fitting existing/new page and cross-link it appropriately.
5. Validate references, Markdown, paths, and the final diff.
   Repository mapping found an existing product-specific Splunk page, so I will prefer extending it over creating a duplicate. Next I’m comparing its structure with the Linux cross-link, PostgreSQL primitives, and nearby web/service pages.
   The content is not duplicated elsewhere: PostgreSQL large-object writes are documented generically, but the Splunk-specific unauthenticated proxy → pg_dump connection-string override → credential-file reuse → malicious restore chain is absent. I’ll add that chain only to the existing Splunk page and retain its current bidirectional link to the local LPE/persistence page.
   Implementation plan is now fixed: extend the existing Splunk page, retitle it to cover both 8000 and 8089, add a non-destructive probe plus the full abstracted recovery-chain mechanics, and append only the sources actually used. No new page or duplicate technique section is needed.
   The page has been updated. I’m now verifying the internal link, citation numbering, long-code-block limits, whitespace, and mdBook build behavior before finalizing.
   Updated HackTricks with the Splunk PostgreSQL Sidecar exploitation chain.

Changes

• Expanded src/network-services-pentesting/8089-splunkd.md with:
  • Loopback sidecar exposure through Splunk’s raw proxy.
  • Non-destructive detection request.
  • backupFile path traversal and truncation.
  • libpq connection-string injection.
  • .pgpass credential reuse.
  • Malicious pg_restore archive and lo_export file write.
  • File-write-to-RCE chain and exploitation constraints.
  • Primary and official references.
• Renamed the page/navigation entry to cover ports 8000 and 8089.
• Preserved the existing cross-link to Splunk LPE and persistence documentation.

Validation passed with git diff --check and custom Markdown/reference checks. mdbook build could not run because mdbook is not installed.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://labs.watchtowr.com/why-use-app-level-auth-when-every-database-has-auth-splunk-enterprise-cve-2026-20253-pre-auth-rce

Content Categories: Based on the analysis, this content was categorized under "Network Services Pentesting → 80,443 - Pentesting Web Methodology → Splunk (new product-specific page), cross-linked with Linux Hardening → Software Information → Splunk LPE and Persistence".

Repository Maintenance:

• MD Files Formatting: 1031 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0