Splunk Enterprise Security

Why are users able to view data in index by directly clicking the search link even though they don't have permission on that index?

akchauhan
Explorer

We observed a security loophole in Splunk Enterprise Security. We have restricted permission on "Y" index in Splunk to "X" role participants only. Other members, except team X, are not able to view data in that index when they are running query (index="Y") but when someone from x team forwards the search link after running query index="Y" to other team, they are able to view data in that index. I believe the reason is when they share the search link they are sharing sid associated with that search, which is why security is bypassed.

Can someone please help us to understand why this is happening?

0 Karma
1 Solution

LukeMurphey
Champion

The confusing part is in regards to exactly what Splunk is sharing when you use the sharing link. Splunk is sharing the results of a particular search job, not the underlying data. Basically, it allows another user to view the results that you saw when you ran a given search. This doesn't mean the that user you send the link to can even run the search themselves. Thus, someone who views the results from the shared job might get no results if they tell Splunk to try to rerun the search since they might not have access to the indexes.

Effectively, it is kind of like exporting the results page to PDF and sending it to someone who doesn't have access to the indexes. The user still sees the results even though they have no access to the data directly.

When you click the share link on the search Splunk modifies the search job in two ways:

  1. Sets read permissions to everyone (since it doesn't know who you are sending the search results too)
  2. Updates the job lifetime so the results won't get deleted for 7 days

Note that the share search dialog tries to make this apparent by indicating:

The job's lifetime has been extended to 7 days and read permissions have been set to Everyone. 

View solution in original post

LukeMurphey
Champion

The confusing part is in regards to exactly what Splunk is sharing when you use the sharing link. Splunk is sharing the results of a particular search job, not the underlying data. Basically, it allows another user to view the results that you saw when you ran a given search. This doesn't mean the that user you send the link to can even run the search themselves. Thus, someone who views the results from the shared job might get no results if they tell Splunk to try to rerun the search since they might not have access to the indexes.

Effectively, it is kind of like exporting the results page to PDF and sending it to someone who doesn't have access to the indexes. The user still sees the results even though they have no access to the data directly.

When you click the share link on the search Splunk modifies the search job in two ways:

  1. Sets read permissions to everyone (since it doesn't know who you are sending the search results too)
  2. Updates the job lifetime so the results won't get deleted for 7 days

Note that the share search dialog tries to make this apparent by indicating:

The job's lifetime has been extended to 7 days and read permissions have been set to Everyone. 
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...