Splunk Low Privilege User Can View Hashed Splunk Password
Description
In Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, a low-privilege user who holds the user role can see the hashed version of the initial user name and password for the Splunk instance by using the rest SPL command against the conf-user-seed REST endpoint. This can lead to a privilege escalation that lets the user take over the admin account on the instance.
- Type: Hunting
-
Product: Splunk Enterprise
- Last Updated: 2023-05-09
- Author: Rod Soto, Eric McGinnis, Chase Franklin
- ID: a1be424d-e59c-4583-b6f9-2dcc23be4875
Annotations
Kill Chain Phase
- Exploitation
NIST
- DE.AE
CIS20
- CIS 10
CVE
Search
1
2
3
4
`splunkd_web` uri="*/servicesNS/nobody/system/configs/conf-user-seed*"
| stats earliest(_time) as event_time values(method) as method values(status) as status values(clientip) as clientip values(useragent) as useragent values(file) as file by user
| convert ctime(*time)
| `splunk_low_privilege_user_can_view_hashed_splunk_password_filter`
Macros
The SPL above uses the following Macros:
splunk_low_privilege_user_can_view_hashed_splunk_password_filter is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Required fields
List of fields required to use this analytic.
- _time
- clientip
- useragent
- file
- user
- method
- status
How To Implement
This detection does not require you to ingest any new data. The detection does require the ability to search the _audit index. This detection may assist in efforts to discover attempts to access con-user-seed file content.
Known False Positives
This search may produce false positives as accounts with high privileges may access this file. Operator will need to investigate these actions in order to discern exploitation attempts.
Associated Analytic Story
RBA
Risk Score | Impact | Confidence | Message |
---|---|---|---|
81.0 | 90 | 90 | Attempt to access Splunk hashed password file from $clientip$ |
The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.
Reference
Test Dataset
Replay any dataset to Splunk Enterprise by using our replay.py
tool or the UI.
Alternatively you can replay a dataset into a Splunk Attack Range
source | version: 1