topic Rundeck App for Splunk token value exposed in log events in All Apps and Add-ons

Rundeck App for Splunk token value exposed in log events

sylbaea — Tue, 25 Sep 2018 04:46:30 GMT

Hello,

During troubleshooting, I noticed token value is exposed in clear text in some log events... That is not very good from a security perspective. Could you please fix that... below a sample event:

09-25-2018 04:42:08.751 +0000 ERROR ExecProcessor - message from "python <...>/splunk/etc/apps/rundeck_app/bin/rundeck.py" ERROR:Rundeck:rundeck://users : HTTP Request error: 400 Client Error: Bad Request for url: https://<FQDN>/api/18/user/list?authtoken=<MY TOKEN !>

Regards.

Re: Rundeck App for Splunk token value exposed in log events

plambert — Tue, 25 Sep 2018 20:24:35 GMT

Thank you for pointing this out. We're looking at it and will have a workaround and/or fix as soon as possible.

Paul M. Lambert
Platform Solutions Architect
Rundeck, Inc

Re: Rundeck App for Splunk token value exposed in log events

plambert — Tue, 25 Sep 2018 23:29:47 GMT

If you need an immediate workaround, please comment out line 346 of $SPLUNK_HOME/etc/apps/rundeck_app/bin/rundeck.py.

We will have a new version with the correct fix (and not a workaround) released as soon as we can.

Thank you again for noticing and reporting this.

Paul M. Lambert
Platform Solutions Architect
Rundeck, Inc

Re: Rundeck App for Splunk token value exposed in log events

plambert — Tue, 02 Oct 2018 22:27:06 GMT

Please reach out to me at plambert@rundeck.com for a patched version of the application that we expect will resolve this issue. If you're able to take the time to verify in your environment that it is resolved, then we will give you the chance to do so before publishing it.

If you don't have the time to verify, we understand, just let me know and the updated version will be published soon after.

Paul M. Lambert
Platform Solutions Architect
Rundeck, Inc

Re: Rundeck App for Splunk token value exposed in log events

sylbaea — Tue, 02 Oct 2018 22:32:16 GMT

just sent you a mail. Thanks.

Re: Rundeck App for Splunk token value exposed in log events

plambertrundeck — Fri, 26 Oct 2018 21:55:44 GMT

Version 1.0.2 of The Rundeck App for Splunk is now available in Splunkbase and addresses this issue. Thank you for your feedback!