topic Re: Information Disclosure Vulnerability - Splunk 7.2.4.2 in Splunk Enterprise

Information Disclosure Vulnerability - Splunk 7.2.4.2

wuka1988 — Wed, 30 Sep 2020 04:31:58 GMT

I have upgraded Splunk Enterprise to 7.2.4.2 as well as the forwarder. However, the Splunk Information Disclosure Vulnerability remains an issue. I can reach this URL unathenticated (https://<>:8000/en-US/splunkd/__raw/services/server/info/server-info?output_mode=json) and receive the disclosed server info. The upgrade should've resolved it per the Splunk doc. (Nessus Plug-in 121164)

Re: Information Disclosure Vulnerability - Splunk 7.2.4.2

nickhills — Tue, 10 Mar 2020 08:54:05 GMT

Are you running an authenticated scan against the endpoint with credentials?

The CVE as discussed here: https://www.splunk.com/view/SP-CAAAP5E
Addresses the issue by moving the endpoint to an authenticated request in versions >6.6.0.

I am not sure why nessus would still detect this in an unauthenticated request

Re: Information Disclosure Vulnerability - Splunk 7.2.4.2

wuka1988 — Wed, 30 Sep 2020 04:32:19 GMT

Well, its not Nessus. It's a Splunk issue. I can reach this URL unauthenticated (https://<>:8000/en-US/splunkd/__raw/services/server/info/server-info?output_mode=json) and get the disclosed information.

Re: Information Disclosure Vulnerability - Splunk 7.2.4.2

wuka1988 — Tue, 10 Mar 2020 16:49:31 GMT

Fixed it. The restmap.conf file (Splunk/etc/system/local/restmap.conf) was set to allow unauthenticated users to view system information through a REST endpoint. The stanzas should read as follows:

[admin:server-info]
requireAuthentication = true

[admin:server-info-alias]
requireAuthentication = true

Re: Information Disclosure Vulnerability - Splunk 7.2.4.2

sgabriel1962 — Fri, 19 Jan 2024 19:56:55 GMT

I have a similar situation in my environment - making the changes to the restmap.conf prevents the App Launcher from loading this is true - and I have version 9.1.2 where the fix must should have been fixed

Re: Information Disclosure Vulnerability - Splunk 7.2.4.2

PickleRick — Fri, 19 Jan 2024 21:08:53 GMT

Hi @sgabriel1962

As you noticed yourself, you're responding to an old thread regarding a relatively old and unsupported version of Splunk. So even if your problem seems similar, it is quite likely that it's caused by different thing (especially that original one was supposed to be due to a but which should have been patched long ago).

Instead of digging up an old thread, it's better to create a new one with a detailed description of your problem (and possibly a link to the old thread as a reference to something you'd found while looking for solutions but what may not be applicable to your situation).