Cross-user data access via geostats SPL injection

SPL injection in Splunk Enterprise before 10.4.2, 10.2.6, 10.0.9, and 9.4.14 lets remote authenticated users run another user's searches. The geostats command does not sufficiently validate attacker-controlled input before Splunk Enterprise processes it into SPL, so a crafted geostats search can execute injected commands with the victim user's permissions when opened in Splunk Web. Exploitation requires a low-privileged account without the admin or power roles and a phishing step that causes another authenticated user to initiate the search; the resulting access is bounded by that second user's data and lookup-file permissions.