Hello,
So we have website hosted in Splunk. We are detecting these vulnerabilities Server header Detected, Incorrect X-Xss-Protection and Incorrect Set-Cookie which has issue category as Insecure HTTP Header. We would like to know on how to resolve this vulnerabilities? Thanks!
Regards,
Joshua
What version of Splunk?
Also - are you serving Splunk directly, or is there a load balancer doing SSL offload perhaps?
The cookies should be set to secure if Splunk is running with native SSL, however you can control the response headers separately if you need to.
Take a look at https://docs.splunk.com/Documentation/Splunk/8.1.0/Admin/Webconf
in web.conf you should be able to set:
[httpServer]
replyHeader.X-XSS-Protection=1; mode=block
Hi,
We are hosting the website in Splunk directly. We are not using load balancer. The SSL certificate we use is signed by Digital 3rd Party Certificate Authority. Our Splunk version is Splunk 7.2.1. So we can just add this config in the web.conf file to resolve the issue? Will editing the web.conf file cause issue to our production instance?
[httpServer]
replyHeader.X-XSS-Protection=1; mode=block
Regards,
Joshua
Are you running Splunk with SSL/HTTPS?
Hello,
Yes, we are already running Splunk with SSL/HTTPS. Do we need to perform further actions? We are still detecting vulnerabilities.
Regards,
Joshua