In Cisco Talos Intelligence for Enterprise Security Cloud versions below 1.0.3, specifically version 1.0, the Talos intelligence enrichment REST API endpoint accepts the destination for authenticated Splunk management requests from request data without sufficient validation. A user with the get_talos_enrichment capability can exploit this by sending a crafted request that causes the instance to make an outbound request to an attacker-controlled server. This can lead to exposure of tokens that compromise all relevant data and system integrity within the Splunk instance.

Successful exploitation allows an attacker with limited privileges (get_talos_enrichment capability) to cause the vulnerable system to send requests to attacker-controlled servers, potentially exposing authentication tokens. This exposure can compromise confidentiality, integrity, and availability of data and system components in the affected Splunk instance.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. There is no official fix or temporary mitigation level stated in the available data. Users should monitor the official Splunk and Cisco Talos advisories for updates and apply any forthcoming patches promptly. Until a fix is available, restrict roles with get_talos_enrichment capability to trusted users only.