topic Re: How to create two different fields using regex from one fields? in Splunk Search

How to create two different fields using regex from one fields?

karu0711 — Thu, 03 Nov 2022 16:01:56 GMT

This call to java.lang.Runtime.exec() contains a command injection flaw. The argument to the function is constructed using untrusted input. If an attacker is allowed to specify all or part of the command, it may be possible to execute commands on the server with the privileges of the executing process. The level of exposure depends on the effectiveness of input validation routines, if any. The first argument to exec() contains tainted data from the variables (new String\[...\]). The tainted data originated from an earlier call to AnnotationVirtualController.vc_annotation_entry. Validate all untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible. When using blocklists, be sure that the sanitizing routine performs a sufficient number of iterations to remove all instances of disallowed characters. Most APIs that execute system commands also have a "safe" version of the method that takes an array of strings as input rather than a single string, which protects against some forms of command injection. References: <a href="https://cwe.mitre.org/data/definitions/78.html">CWE</a> <a href="https://owasp.org/www-community/attacks/Command_Injection">OWASP</a>

This fields value from where I need to create 2 separate fields

First field call flaw extract from "This call to java.lang.Runtime.exec() contains a command injection flaw. The argument to the function is constructed using untrusted input. If an attacker is allowed to specify all or part of the command, it may be possible to execute commands on the server with the privileges of the executing process. The level of exposure depends on the effectiveness of input validation routines, if any. The first argument to exec() contains tainted data from the variables (new String\[...\]). The tainted data originated from an earlier call to AnnotationVirtualController.vc_annotation_entry. "<\span>

second fields call rededication start from

Validate all untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible. When using blocklists, be sure that the sanitizing routine performs a sufficient number of iterations to remove all instances of disallowed characters. Most APIs that execute system commands also have a "safe" version of the method that takes an array of strings as input rather than a single string, which protects against some forms of command injection.<\span>

Re: I need help with regex? How do I create two different fields using regex from one fields?

richgalloway — Thu, 03 Nov 2022 15:58:09 GMT

The easiest way to extract two fields from a complex string like that is by using two different rex commands.

The first might be

| rex "contains a (?<flaw>.*?) flaw"

The second would be similar, but I don't have an example because it's not clear where the "call redirection" is in the data.

Re: How to create two different fields using regex from one fields?

ITWhisperer — Thu, 03 Nov 2022 16:12:08 GMT

| rex "(?<callflaw>.+)\s*(?<rededication>.+)"

Re: How to create two different fields using regex from one fields?

karu0711 — Fri, 04 Nov 2022 12:48:31 GMT

This regex creating field where it includes callflaw and remediation in one field. Is it possible to separate those into seprate fields?

callflaw

"This call to java.lang.Runtime.exec() contains a command injection flaw. The argument to the function is constructed using untrusted input. If an attacker is allowed to specify all or part of the command, it may be possible to execute commands on the server with the privileges of the executing process. The level of exposure depends on the effectiveness of input validation routines, if any. The first argument to exec() contains tainted data from the variables (new String\[...\]). The tainted data originated from an earlier call to AnnotationVirtualController.vc_annotation_entry. "

Remediation

"Validate all untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible. When using blocklists, be sure that the sanitizing routine performs a sufficient number of iterations to remove all instances of disallowed characters. Most APIs that execute system commands also have a "safe" version of the method that takes an array of strings as input rather than a single string, which protects against some forms of command injection."

Like this?

Re: How to create two different fields using regex from one fields?

ITWhisperer — Fri, 04 Nov 2022 15:29:49 GMT

That is what the rex expression is doing - the first part between the first and goes in callflaw and the second part goes in remediation.