Information Disclosure Vulnerability - Splunk 7.2.4.2

[wuka1988]

I have upgraded Splunk Enterprise to 7.2.4.2 as well as the forwarder. However, the Splunk Information Disclosure Vulnerability remains an issue. I can reach this URL unathenticated (https://<>:8000/en-US/splunkd/__raw/services/server/info/server-info?output_mode=json) and receive the disclosed server info. The upgrade should've resolved it per the Splunk doc. (Nessus Plug-in 121164)

[wuka1988]

Fixed it. The restmap.conf file (Splunk/etc/system/local/restmap.conf) was set to allow unauthenticated users to view system information through a REST endpoint. The stanzas should read as follows:

[admin:server-info]
requireAuthentication = true

[admin:server-info-alias]
requireAuthentication = true

[nickhills]

Are you running an authenticated scan against the endpoint with credentials?

The CVE as discussed here: https://www.splunk.com/view/SP-CAAAP5E
Addresses the issue by moving the endpoint to an authenticated request in versions >6.6.0.

I am not sure why nessus would still detect this in an unauthenticated request

[wuka1988]

Well, its not Nessus. It's a Splunk issue. I can reach this URL unauthenticated (https://<>:8000/en-US/splunkd/__raw/services/server/info/server-info?output_mode=json) and get the disclosed information.

[sgabriel1962]

I have a similar situation in my environment - making the changes to the restmap.conf prevents the App Launcher from loading  this is true  -  and I have version 9.1.2  where the fix must should have been fixed

[PickleRick]

Hi @sgabriel1962 

As you noticed yourself, you're responding to an old thread regarding a relatively old and unsupported version of Splunk. So even if your problem seems similar, it is quite likely that it's caused by different thing (especially that original one was supposed to be due to a but which should have been patched long ago).

Instead of digging up an old thread, it's better to create a new one with a detailed description of your problem (and possibly a link to the old thread as a reference to something you'd found while looking for solutions but what may not be applicable to your situation).