How to disable the ability to process ANSI escape codes in terminal applications?

[feichinger]

Hello

we've been advised to "Disable the ability to process ANSI escape codes in terminal applications" and I honestly don't know what that really means and can't find much guidance around that.

It wouldn't be something we actively use but I just don't know if that's enabled by default or not. Can someone help me figure out how to ensure this is disabled?

We have a simple standalone environment with data just coming in from universal forwarders reading local logs.

Thanks in advance,
Felix

[PickleRick · Accepted solution]

The SVD-2023-0606 was also recently updated.

Anyway, see my response in the other thread https://community.splunk.com/t5/Security/Disable-ANSI-escape-codes/m-p/652082

[feichinger]

the advise now made it to the security alerts page and is said to only be about SOAR

https://advisory.splunk.com/advisories/SVD-2023-0702

I'd still be interested to know if "ANSI escape codes in terminal applications" is a thing in Splunk Enterprise, since the general advise is to have that deactivated, but it seems the immediate thread is only about SOAR and to be fixed with installing the latest version

[NeverSIEMless]

This is still a thing in Splunk Enterprise. 

Depending on your environment such as your version, deployment size and production hrs etc, you may find it easier to upgrade to the versions that are safe from this vuln.

These are 8.2.11.2, 9.0.5.1 or 9.1.0.2 for Splunk Enterprise. 

If you do this option, you still need to purge some logs as they may still pose a risk, Splunk recommends removing the log files in $SPLUNK_HOME/var/logs/splunk/

Hope this helps!

[PickleRick]

Wait a second. Don't push people into:

1) Rushing to upgrades

2) Removing logs

without proper risk analysis.

The CVE score is indeed high but the actual exploitability is limited.

In order to successfuly exploit this vulnerability one would need to first inject the ANSI sequences into the log files and then count on an admin to display this particular part of the log with a non-filtering tool.

The attack surface would depend on many factors such as:

1) Do you allow connectivity to your splunk components from everywhere or just a limited set of hosts?

2) Do you do any local work on the splunk components at all or do you manage them by means of some config management tools (like ansible)?

3) If you check the contents of log files do you use cat/tail/grep or do you use safe tools like less?

So it's not that straightforward - oooooh, you have a RCE vulnerability, go upgrade at once or you're doomed!

Don't spread panic, please.

I'm not saying that you are 100% safe, mind you. Noone responsible will tell you that. Ever. But please approach the situation responsibly and cautiously.

[a1bg503461]

I would like to have an update about it too