Try in Splunk Security Cloud

Description

In Splunk Add-on Builder versions below 4.1.4, the application writes sensitive information to its internal log files when you visit the Splunk Add-on Builder or when you build or edit a custom app or add-on.

  • Type: Hunting

  • Product: Splunk Enterprise

  • Last Updated: 2024-01-30
  • Author: Rod Soto, Eric McGinnis
  • ID: b7b82980-4a3e-412e-8661-4531d8758735

Annotations

ATT&CK

ATT&CK

ID Technique Tactic
T1082 System Information Discovery Discovery
Kill Chain Phase
  • Exploitation
NIST
  • DE.AE
CIS20
  • CIS 10
CVE 


1
2
3
4
5
6
7
8



| rest /services/apps/local 
| search disabled=0 core=0 label="Splunk Add-on Builder" 
| dedup label 
| search version < 4.1.4 
| eval WarningMessage="Splunk Add-on Builder Versions older than v4.1.4 contain a critical vulnerability. Update to Splunk Add-on Builder v4.1.4 or higher immediately. For more information about this vulnerability, please refer to https://advisory.splunk.com/advisories/SVD-2024-0111" 
| table label version WarningMessage 
| `splunk_information_disclosure_in_splunk_add_on_builder_filter`

Macros

The SPL above uses the following Macros:

:information_source: splunk_information_disclosure_in_splunk_add-on_builder_filter is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Required fields

List of fields required to use this analytic.

  • disabled
  • core
  • version
  • label

How To Implement

This search should be run on search heads where Splunk Add-on Builder may be installed. The results of this search will conclusively show whether or not a vulnerable version of Splunk Add-on Builder is currently installed.

Known False Positives

This search is highly specific for vulnerable versions of Splunk Add-on Builder. There are no known false positives.

Associated Analytic Story

RBA

Risk Score Impact Confidence Message
100.0 100 100 Vulnerable $version$ of Splunk Add-on Builder found - Upgrade Immediately.

:information_source: The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.

Reference

Test Dataset

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

source | version: 1