Splunk CSRF in the SSG kvstore Client Endpoint

SPLUNK detection rule by Rod Soto · Apache-2.0

The following analytic identifies attempts to exploit a cross-site request forgery (CSRF) vulnerability in the Splunk Secure Gateway (SSG) app's kvstore_client endpoint. It detects GET requests to the vulnerable endpoint using internal index data, focusing on specific URI paths and HTTP methods. This activity is significant because it can allow unauthorized updates to SSG KV store collections, potentially leading to data manipulation or unauthorized access. If confirmed malicious, this could enable attackers to alter critical configurations or exfiltrate sensitive information, compromising the integrity and security of the Splunk environment.

name: Splunk CSRF in the SSG kvstore Client Endpoint
id: 4742d5f7-ce00-45ce-9c79-5e98b43b4410
version: 7
creation_date: '2023-02-14'
modification_date: '2026-05-14'
author: Rod Soto
status: removed
type: TTP
description: The following analytic identifies attempts to exploit a cross-site request forgery (CSRF) vulnerability in the Splunk Secure Gateway (SSG) app's kvstore_client endpoint. It detects GET requests to the vulnerable endpoint using internal index data, focusing on specific URI paths and HTTP methods. This activity is significant because it can allow unauthorized updates to SSG KV store collections, potentially leading to data manipulation or unauthorized access. If confirmed malicious, this could enable attackers to alter critical configurations or exfiltrate sensitive information, compromising the integrity and security of the Splunk environment.
data_source:
    - Splunk
search: '`splunkda` uri_path="/*/splunkd/__raw/services/ssg/kvstore_client" method="GET" delete_field_value="spacebridge_server" status="200"  | table splunk_server status uri delete_field_value method post_data  | `splunk_csrf_in_the_ssg_kvstore_client_endpoint_filter`'
how_to_implement: Requires access to internal index.
known_false_positives: This hunting search only applies to the affected versions and setup mentioned in the description of this search, it does not extract payload so it requires manual investigation after executing search. This search will produce false positives.
references:
    - https://advisory.splunk.com/advisories/SVD-2023-0212
drilldown_searches:
    - name: View the detection results for $splunk_server$
      search: '%original_detection_search% | search  splunk_server = $splunk_server$'
      earliest_offset: $info_min_time$
      latest_offset: $info_max_time$
    - name: View risk events for the last 7 days for $splunk_server$
      search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ($splunk_server$) starthoursago=168 endhoursago=1 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
      earliest_offset: $info_min_time$
      latest_offset: $info_max_time$
rba:
    message: Potential CSRF exploitation attempt from $splunk_server$
    risk_objects:
        - field: splunk_server
          type: system
          score: 25
    threat_objects: []
tags:
    analytic_story:
        - Splunk Vulnerabilities
    asset_type: Endpoint
    cve:
        - CVE-2023-22942
    mitre_attack_id:
        - T1189
    product:
        - Splunk Enterprise
        - Splunk Enterprise Security
        - Splunk Cloud
    security_domain: threat
tests:
    - name: True Positive Test
      attack_data:
          - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/splunk/splunk_csrf_in_the_ssg_kvstore_client_endpoint_data.log
            source: splunkd_access.log
            sourcetype: splunkd_access
            custom_index: _internal
deprecation_info:
    reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release.
    removed_in_version: 5.6.0
    replacement_content: []

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

32bc3b5c-9bb7-4c1a-88fd-428203ed5090

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion