Privilege escalation for users who hold the “splunk_app_soar“ role in the Splunk App for SOAR

Description

In versions 1.0.67 and lower of the Splunk App for SOAR, the Splunk documentation for that app recommended adding the admin_all_objects capability to the splunk_app_soar role. This addition could lead to improper access control for a low-privileged user that does not hold the “admin“ Splunk roles.

Solution

Upgrade Splunk App for SOAR to version 1.0.71 or higher.

Product Status

Mitigations and Workarounds

If you can not upgrade to 1.0.71, or higher., you could remove the admin_all_objects capability from a low-privileged user who holds the splunk_app_soar role.
For more information, see Assign roles for Splunk App for SOAR and Define roles on the Splunk platform with capabilities

Detections

None

Severity

Splunk rates this vulnerability a 6.4, Medium, with a CVSSv3.1 vector of CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N.

Acknowledgments

Gabriel Nitu, Splunk