Splunk Enterprise

Information Disclosure Vulnerability - Splunk 7.2.4.2

wuka1988
Explorer

I have upgraded Splunk Enterprise to 7.2.4.2 as well as the forwarder. However, the Splunk Information Disclosure Vulnerability remains an issue. I can reach this URL unathenticated (https://<>:8000/en-US/splunkd/__raw/services/server/info/server-info?output_mode=json) and receive the disclosed server info. The upgrade should've resolved it per the Splunk doc. (Nessus Plug-in 121164)

Tags (1)
0 Karma

wuka1988
Explorer

Fixed it. The restmap.conf file (Splunk/etc/system/local/restmap.conf) was set to allow unauthenticated users to view system information through a REST endpoint. The stanzas should read as follows:

[admin:server-info]
requireAuthentication = true

[admin:server-info-alias]
requireAuthentication = true

nickhills
Ultra Champion

Are you running an authenticated scan against the endpoint with credentials?

The CVE as discussed here: https://www.splunk.com/view/SP-CAAAP5E
Addresses the issue by moving the endpoint to an authenticated request in versions >6.6.0.

I am not sure why nessus would still detect this in an unauthenticated request

If my comment helps, please give it a thumbs up!

wuka1988
Explorer

Well, its not Nessus. It's a Splunk issue. I can reach this URL unauthenticated (https://<>:8000/en-US/splunkd/__raw/services/server/info/server-info?output_mode=json) and get the disclosed information.

0 Karma

sgabriel1962
Explorer

I have a similar situation in my environment - making the changes to the restmap.conf prevents the App Launcher from loading  this is true  -  and I have version 9.1.2  where the fix must should have been fixed

 

0 Karma

PickleRick
SplunkTrust
SplunkTrust

Hi @sgabriel1962 

As you noticed yourself, you're responding to an old thread regarding a relatively old and unsupported version of Splunk. So even if your problem seems similar, it is quite likely that it's caused by different thing (especially that original one was supposed to be due to a but which should have been patched long ago).

Instead of digging up an old thread, it's better to create a new one with a detailed description of your problem (and possibly a link to the old thread as a reference to something you'd found while looking for solutions but what may not be applicable to your situation).

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...