All Apps and Add-ons

Several json pages in Security essentials don't authenticate the user if the full url is typed in.

jlstanley
Path Finder

there are 2 web pages in the Security Essentials app that come up on security scans without authenticating. Authentication is setup with azure federation and works fine normally but if you type in the full url to these 2 locations:
http://splunk.domain
.net/static/app/Splunk_Security_Essentials/components/data/ShowcaseInfo.json
or
http://splunk.domain.net/en-US/static/@D9F7C1F9464941AC960FA32AE0179322246AFEEF74E65DB88455B73C7C752...

0 Karma

David
Splunk Employee
Splunk Employee

This is more-or-less by design, and is owned by Splunk Enterprise. No sensitive data is stored in those JSON files, only default out-of-the-box content. Anything custom gets tossed into the kvstore.

Are you running into any issues given that those files are exposed?

0 Karma

jlstanley
Path Finder

Not an issue per se, other than the fact it is accessible without authenticating. Can it be fixed or is there a work around so it doesn't come up in security scans?

0 Karma

David
Splunk Employee
Splunk Employee

The answer today is that you can’t work around this. My guess is that we have it set up like this because we can expose reports without authentication – there’s an embedded auth code in those links for the initial request of the report, but some reports can require static web assets and maintaining the auth code gets tricky. The PM response the last time this came up was as follows, basically indicating that nothing in there should ever be private:

$APP_HOME/appserver/static directory contains web resources such as images, CSS or HTML used by the app and these resources don’t need any authentication.
http://docs.splunk.com/Documentation/Splunk/6.4.0/AdvancedDev/ShareYourWork#Files_and_directories_fo...

That said, that was from two years ago -- I'll ask if there's any plan to make changes here and let you know.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...