Sensitive Information Disclosure in "_internal" index in Splunk Enterprise

Description

In Splunk Enterprise versions below 10.2.0, 10.0.2, 9.4.7, 9.3.9, and 9.2.11, a user of a Splunk Search Head Cluster (SHC) deployment who holds a role with access to the Splunk _internal index could view the integrationKey, secretKey, and appSecretKey secrets, generated by Duo Two-Factor Authentication for Splunk Enterprise, in plain text.

See the following for more information:

• Specify searchable indexes for a role
• Configure Splunk Enterprise to use Duo Security multifactor authentication
• Duo Multi-Factor Authentication (MFA) vendor settings in the Authentication.conf configuration file reference

Solution

Upgrade Splunk Enterprise to versions 10.2.0, 10.0.2, 9.4.7, 9.3.9, 9.2.11, or higher.

Product Status

Mitigations and Workarounds

To eliminate further risk and help ensure a high level of security in your environment, you must perform the following recommended actions:

• Rotate the integrationKeysecret from your Duo configuration. You can find this key on your Duo Security configuration page or at Configuration > Details.
• Rotate the secretKey secret from your Duo Security configuration or detail. You can find this key on your Duo Security configuration page or at Configuration > Details.
• Manually generate the appSecretKey secret ( Duo Multi-Factor Authentication (MFA) vendor settings in the authentication.conf configuration file).

Detections

None

Severity

Splunk rates this vulnerability a 6.8, Medium, with a CVSSv3.1 vector of CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.