Monitoring Splunk

CERN HTTPD Access Control Bypass (Splunkd service)

rgilliam
Engager

Vulnerability scanning software returned the following result for a handful of systems in my environment:

"There exists a vulnerability in the CERN web server running on this
host that could allow an attacker to gain access to sensitive files on the
system.
Service: Splunkd
CVSSv2: AV:N/AC:L/Au:P/C:N/I:N/A:N (Base Score:5.00)

Remediation Action: Filter out input such as '//' and '/./' from page requests."

Has anyone run across something similar? I'm assuming the service is needed for the Universal Forwarder, but not sure why only a few systems are reporting this vulnerability and not all. The hosts in question are running WIN2012.

Tags (1)

jbsplunk
Splunk Employee
Splunk Employee

This has been reported to Splunk previously. The vulnerability associated with this finding is CVE-2008-0252.

Splunk has tried to reproduce and found that directory traversal with "//" and "/./" is not possible with any CherryPy web server that ships with Splunk. As per the Mitre vulnerability:

 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0252

       Directory traversal vulnerability in the _get_file_path function in 
    (1) lib/sessions.py in CherryPy 3.0.x up to 3.0.2, 
    (2) filter/sessionfilter.py in CherryPy 2.1, and 
    (3) filter/sessionfilter.py in CherryPy 2.x allows remote attackers to create or delete arbitrary files, and possibly read and write portions of arbitrary files, via a crafted session id in a cookie.

In 5.0 and above, Splunk ships with CherryPy 3.1.2. If the version of Splunk you're running is close to current, this is almost certainly a false positive. You should proceed by reporting it as such to the vendor who reported the finding so they can tweak the vulnerability check.

As an aside, any vulnerabilities discovered can be reported to Splunk via the security portal at this link:

https://www.splunk.com/goto/report_vulnerabilities
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...