Detection: Splunk Image File Disclosure via PDF Export in Classic Dashboard

Updated Date: 2024-10-14 ID: 7464e2dc-98a5-4af9-87a1-fa6d5a256fa6 Author: Rod Soto Type: Hunting Product: Splunk Enterprise Security

Description

In Splunk Enterprise versions 9.3.0, 9.2.3, and 9.1.6, a low-privileged user that does not hold the “admin” or “power” Splunk roles could view images on the host machine using the PDF export feature in Splunk classic dashboards.

 1```Search for any PDFs that have been generated```
 2index=_internal sourcetype=splunk_pdfgen "Generated pdf" 
 3```Extract a potential Dashboard Filename```
 4
 5| rex field=filename "(?<title>.*)-[0-9]{4}-[0-9]{1,2}-[0-9]{1,2}.pdf" 
 6```Join this with all dashboards. Potentially vulnerable dashbaords MUST be classic (version 1.1) AND contain at least one <img...> tag```
 7
 8| join type=inner title 
 9    [
10| rest /servicesNS/-/-/data/ui/views 
11    
12| search eai:data="*<img*" version="1.1"] 
13
14| stats count min(_time) as earliestTime max(_time) as latestTime by author eai:acl.app label title eai:data
15
16| `security_content_ctime(earliestTime)`
17
18| `security_content_ctime(latestTime)`
19
20| `splunk_image_file_disclosure_via_pdf_export_in_classic_dashboard_filter`

Data Source

Name Platform Sourcetype Source Supported App
Splunk Splunk icon Splunk 'splunkd_ui_access' 'splunkd_ui_access.log' N/A

Macros Used

Name Value
security_content_ctime convert timeformat="%Y-%m-%dT%H:%M:%S" ctime($field$)
splunk_image_file_disclosure_via_pdf_export_in_classic_dashboard_filter search *
splunk_image_file_disclosure_via_pdf_export_in_classic_dashboard_filter is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Annotations

- MITRE ATT&CK
+ Kill Chain Phases
+ NIST
+ CIS
- Threat Actors
ID Technique Tactic
T1087 Account Discovery Discovery
KillChainPhase.EXPLOITAITON
NistCategory.DE_AE
Cis18Value.CIS_10
FIN13

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Setting Value
Disabled true
Cron Schedule 0 * * * *
Earliest Time -70m@m
Latest Time -10m@m
Schedule Window auto
Creates Risk Event False
This configuration file applies to all detections of type hunting.

Implementation

Need to access to REST API.

Known False Positives

This is a hunting search and operator must identify indicators of local host image source such as UNC paths ('C:'', '//'') in order to identify potential exploitation of this vulnerability.

Associated Analytic Story

Risk Based Analytics (RBA)

Risk Message Risk Score Impact Confidence
Potential disclosure of local system source images in dashbaord $label$ by $author$ 8 10 80
The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.

References

Detection Testing

Test Type Status Dataset Source Sourcetype
Validation ✅ Passing N/A N/A N/A
Unit ✅ Passing N/A N/A N/A
Integration ✅ Passing N/A N/A N/A

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub | Version: 1