Description

In Cisco Talos Intelligence for Enterprise Security Cloud versions below 1.0.3, a user that holds a role with the get_talos_enrichment capability could send a crafted request to the Talos intelligence enrichment Representational State Transfer (REST) API endpoint and cause the instance to make an outbound request to an attacker-controlled server. The request could expose tokens that compromise all relevant data and system integrity in the Splunk instance. The vulnerability is possible because the Talos intelligence enrichment REST endpoint accepts the destination for authenticated Splunk management requests from request data. For more information see Deploy Cisco Talos Intelligence for Splunk Enterprise Security (https://help.splunk.com/en/splunk-enterprise-security-8/user-guide/8.0/introduction/deploy-cisco-talos-intelligence-for-splunk-enterprise-security-cloud-only) in the Splunk documentation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-19T22:17:25.220Z",
  "pubdate": "2026-08-19T22:17:25.220Z",
  "executiveSummary": "Cisco Talos Intelligence for Enterprise Security Cloud versions below 1.0.3 suffer from a Server-Side Request Forgery (SSRF) vulnerability. This security flaw enables a low-privileged authenticated user possessing the get_talos_enrichment capability to manipulate the Talos intelligence enrichment REST API endpoint.\nBy supplying a crafted destination parameter within request data, an attacker can force the vulnerable Splunk instance to execute arbitrary outbound HTTP requests targeting an attacker-controlled server.\nThe primary impact of successful exploitation involves the unauthorized exposure of sensitive authentication tokens. The leakage of these security tokens severely compromises the confidentiality, integrity, and availability of all relevant data and system resources within the affected Splunk instance.\nThe vulnerability represents a critical risk to enterprise security environments utilizing vulnerable plugin versions, as it bypasses standard network boundaries via trusted application functionality. Exploitation requires prior authentication with specific role-based capabilities, but no complex interaction beyond sending a maliciously crafted REST API request.",
  "technicalDetails": "The root cause of the vulnerability resides in insecure input handling within the Talos intelligence enrichment REST API endpoint. Specifically, the affected component dynamically accepts and processes the destination parameter for authenticated Splunk management requests directly from incoming request data without sufficient validation, sanitization, or restriction against internal or arbitrary external endpoints.\nThe affected product is Cisco Talos Intelligence for Enterprise Security Cloud, specifically targeting versions below 1.0.3. The vulnerable component is the REST API endpoint responsible for Talos intelligence enrichment within the application architecture.\nExploitation requires network exposure to the Splunk Enterprise Security REST API interface, an authenticated session, and a user role assigned the get_talos_enrichment capability. While authentication and specific capability requirements are mandatory, they present a significantly reduced barrier if an attacker compromises a standard user account or exploits overly permissive role assignments.\nThe step-by-step attack flow proceeds as follows: First, an authenticated attacker holding the get_talos_enrichment capability formulates a malicious payload targeting the Talos intelligence enrichment REST endpoint. Second, the attacker injects an arbitrary destination URL pointing to an external attacker-controlled server into the request data structure. Third, the vulnerable Splunk instance parses the request and improperly trusts the supplied destination parameter. Fourth, the application initiates an outbound server-side HTTP request toward the attacker's infrastructure, inadvertently transmitting sensitive authentication tokens and session credentials along with the request. Finally, the attacker captures the leaked tokens, achieving complete compromise of system integrity and underlying data within the Splunk environment."
}