Receiving vulnerabilities from our Splunk hosted web server/website

[jmdelrosario26]

Hello,

So we have website hosted in Splunk. We are detecting these vulnerabilities Server header Detected, Incorrect X-Xss-Protection and Incorrect Set-Cookie which has issue category as Insecure HTTP Header. We would like to know on how to resolve this vulnerabilities? Thanks!

Regards,

Joshua

[nickhills]

What version of Splunk?

Also - are you serving Splunk directly, or is there a load balancer doing SSL offload perhaps?

The cookies should be set to secure if Splunk is running with native SSL,  however you can control the response headers separately if you need to.

Take a look at https://docs.splunk.com/Documentation/Splunk/8.1.0/Admin/Webconf

in web.conf you should be able to set:

[httpServer]
replyHeader.X-XSS-Protection=1; mode=block

[jmdelrosario26]

Hi,

We are hosting the website in Splunk directly. We are not using load balancer. The SSL certificate we use is signed by Digital 3rd Party Certificate Authority. Our Splunk version is Splunk 7.2.1. So we can just add this config in the web.conf file to resolve the issue? Will editing the web.conf file cause issue to our production instance? 

[httpServer]
replyHeader.X-XSS-Protection=1; mode=block

Regards,

Joshua

[nickhills]

 Are you running Splunk with SSL/HTTPS?

[jmdelrosario26]

Hello,

Yes, we are already running Splunk with SSL/HTTPS. Do we need to perform further actions? We are still detecting vulnerabilities.

Regards,

Joshua