Try in Splunk Security Cloud

Description

The following analytic identifies the presence of vulnerable versions of Splunk Add-on Builder (below 4.1.4) that write sensitive information to internal log files. It uses REST API queries to check installed app versions and flags those below the secure threshold. This activity is significant because it exposes sensitive data, which could be exploited by attackers. If confirmed malicious, this vulnerability could lead to unauthorized access to sensitive information, compromising the security and integrity of the Splunk environment. Immediate updates to version 4.1.4 or higher are recommended.

  • Type: Hunting

  • Product: Splunk Enterprise

  • Last Updated: 2024-05-20
  • Author: Rod Soto, Eric McGinnis
  • ID: b7b82980-4a3e-412e-8661-4531d8758735

Annotations

ATT&CK

ATT&CK

ID Technique Tactic
T1082 System Information Discovery Discovery
Kill Chain Phase
  • Exploitation
NIST
  • DE.AE
CIS20
  • CIS 10
CVE 


1
2
3
4
5
6
7
8



| rest /services/apps/local 
| search disabled=0 core=0 label="Splunk Add-on Builder" 
| dedup label 
| search version < 4.1.4 
| eval WarningMessage="Splunk Add-on Builder Versions older than v4.1.4 contain a critical vulnerability. Update to Splunk Add-on Builder v4.1.4 or higher immediately. For more information about this vulnerability, please refer to https://advisory.splunk.com/advisories/SVD-2024-0111" 
| table label version WarningMessage 
| `splunk_information_disclosure_in_splunk_add_on_builder_filter`

Macros

The SPL above uses the following Macros:

:information_source: splunk_information_disclosure_in_splunk_add-on_builder_filter is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Required fields

List of fields required to use this analytic.

  • disabled
  • core
  • version
  • label

How To Implement

This search should be run on search heads where Splunk Add-on Builder may be installed. The results of this search will conclusively show whether or not a vulnerable version of Splunk Add-on Builder is currently installed.

Known False Positives

This search is highly specific for vulnerable versions of Splunk Add-on Builder. There are no known false positives.

Associated Analytic Story

RBA

Risk Score Impact Confidence Message
100.0 100 100 Vulnerable $version$ of Splunk Add-on Builder found - Upgrade Immediately.

:information_source: The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.

Reference

Test Dataset

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

source | version: 2