Sensitive Information Disclosure through the storage/passwords REST Endpoint in Splunk Enterprise

Description

In Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.8, and 9.4.13, and Splunk Cloud Platform versions below 10.5.2605.0, 10.4.2604.6, 10.3.2512.15, 10.2.2510.18, and 10.1.2507.24, a low-privileged user that does not hold the ‘admin’ or ‘power’ Splunk roles could view stored credential hashes when they access the /servicesNS/-/-/storage/passwords REST endpoint through the |rest Search Processing Language (SPL) command.

The exposure happens because the |rest SPL command returns the encr_password field in the results of the /servicesNS/-/-/storage/passwords REST endpoint.

Solution

To fix the problem, perform the following procedure on Splunk Enterprise:
1. Upgrade Splunk Enterprise to versions 10.4.1, 10.2.5, 10.0.8, 9.4.13, or higher.
2. In the limits.conf configuration file, under the [storage_passwords_masking] stanza, set mask_encr_password = true.
3. Restart the Splunk Enterprise instance.

For more information, see How to edit a configuration file and the limits.conf configuration specification file.

Splunk is actively monitoring and patching Splunk Cloud Platform instances.

Product Status

Mitigations and Workarounds

None

Detections

None

Severity

Splunk rates this vulnerability a 5.3, Medium, with a CVSSv3.1 vector of CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N.