QualysGuard says splunk is vulnerable to cross-site scripting, is it true?

[matt]

QualysGuard is saying that Splunk is vulnerable to cross-site scripting attacks. Can someone confirm if this a valid threat or just a false-positive?

[araitz · Accepted solution]

This is likely a false positive, as the vulnerability scanner is not expecting a 303 See Other response from Splunk.

Cherrypy, our web server, will often issue a 303 redirect to ensure that the site's root namespace is being used, or to enforce a locale such as /en-US/ in the URL path. Other times, the scanner is not logged in to Splunk, and the invalid session results in a 303 redict to the Splunk login page.

You can take a look at web_access.log to see that the 303 is followed by a 404 (or a 200 OK to the Splunk login page if not logged in).

Similarly, if you visit the link provided in the Qualys report while logged in to Splunk, you will receive a benign 404 error page indicating that the resource is not found rather than anything nefarious. If you are not logged in, you will observe the redirection to the Splunk login page.

[eric2777]

Hi there,

Splunk and Qualys are partners, so I am wondering how can we help to provide additional context and figure out if we need to fix this potential false positive?
Would you please share the QID?

Thanks,
Eric P.
PM @Qualys