Name:Splunk Authentication Token Exposure in Debug Log id:9a67e749-d291-40dd-8376-d422e7ecf8b5 version:9 date:None author:Rod Soto, Chase Franklin status:production type:TTP Description:The following analytic identifies exposed authentication tokens in debug logs within Splunk Enterprise.
It leverages logs from the `splunkd` component with a DEBUG log level, specifically searching for event messages that validate tokens. This activity is significant because exposed tokens can be exploited by attackers to gain unauthorized access to the Splunk environment.
If confirmed malicious, this exposure could lead to unauthorized data access, privilege escalation, and potential compromise of the entire Splunk infrastructure.
Monitoring and addressing this vulnerability is crucial for maintaining the security and integrity of the Splunk deployment. Data_source:
search:`splunkd` component=JsonWebToken log_level=DEBUG eventtype="splunkd-log" event_message="Validating token:*" | rex "Validating token: (?<token>.*)\.$" | search token!=None | stats count min(_time) as firstTime max(_time) as lastTime values(log_level) as log_level values(event_message) as event_message by index, sourcetype, host, token | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `splunk_authentication_token_exposure_in_debug_log_filter`
how_to_implement:Requires access to internal Splunk indexes. known_false_positives:Only applies to affected versions of Splunk Enterprise below 9.2.1, 9.1.4, and 9.0.9 References: -https://advisory.splunk.com/advisories/SVD-2024-0301 drilldown_searches: name:'View the detection results for $host$' search:'%original_detection_search% | search host = $host$' earliest_offset:'$info_min_time$' latest_offset:'$info_max_time$' name:'View risk events for the last 7 days for $host$' search:'| from datamodel Risk.All_Risk | search normalized_risk_object IN ($host$) starthoursago=168 endhoursago=1 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset:'$info_min_time$' latest_offset:'$info_max_time$' analytic_story:['Splunk Vulnerabilities']
