From e376095429c872e1959fb6423d168810a1962304 Mon Sep 17 00:00:00 2001 From: Rod Soto <50486899+rosplk@users.noreply.github.com> Date: Wed, 1 Feb 2023 16:33:44 -0800 Subject: [PATCH 1/5] fixsourcedtypesplunkwebxmacro --- macros/splunkd_webx.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/macros/splunkd_webx.yml b/macros/splunkd_webx.yml index a85f20f4ea..f5bd36df7b 100644 --- a/macros/splunkd_webx.yml +++ b/macros/splunkd_webx.yml @@ -1,4 +1,4 @@ -definition: index=_internal sourcetype=access_combined_wcookie +definition: index=_internal sourcetype=splunk_web_access description: customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. name: splunkd_webx \ No newline at end of file From 2fafe9c0f432fb16244ad2ecbc6e09f7b1c81bd1 Mon Sep 17 00:00:00 2001 From: Rod Soto <50486899+rosplk@users.noreply.github.com> Date: Wed, 1 Feb 2023 16:57:19 -0800 Subject: [PATCH 2/5] fixedtestfilesourcetype --- ...nk_xss_in_save_table_dialog_header_in_search_page.test.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/application/splunk_xss_in_save_table_dialog_header_in_search_page.test.yml b/tests/application/splunk_xss_in_save_table_dialog_header_in_search_page.test.yml index 39998e2df7..0966043317 100644 --- a/tests/application/splunk_xss_in_save_table_dialog_header_in_search_page.test.yml +++ b/tests/application/splunk_xss_in_save_table_dialog_header_in_search_page.test.yml @@ -8,7 +8,7 @@ tests: attack_data: - file_name: splunk_xss_in_save_table_dialog_in_search_page.txt data: https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1189/splunk/splunk_xss_in_save_table_dialog_in_search_page.txt - source: /opt/splunk/var/log/splunk/splunkd_access.log - sourcetype: splunkd_access + source: /opt/splunk/var/log/splunk/web_access.log + sourcetype: splunk_web_access custom_index: _internal update_timestamp: true From 5c81a87b51cae6ce75f912f506ae7f9fa7e61d91 Mon Sep 17 00:00:00 2001 From: Rod Soto <50486899+rosplk@users.noreply.github.com> Date: Wed, 1 Feb 2023 17:08:13 -0800 Subject: [PATCH 3/5] fixedsourcetype --- ...lunk_secure_gateway__splunk_mobile_alerts_feature.test.yml | 4 ++-- ...splunk_reflected_xss_in_the_templates_lists_radio.test.yml | 2 +- ...splunk_stored_xss_via_data_model_objectname_field.test.yml | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/tests/application/splunk_rce_via_splunk_secure_gateway__splunk_mobile_alerts_feature.test.yml b/tests/application/splunk_rce_via_splunk_secure_gateway__splunk_mobile_alerts_feature.test.yml index 9f51b7d748..7acef92668 100644 --- a/tests/application/splunk_rce_via_splunk_secure_gateway__splunk_mobile_alerts_feature.test.yml +++ b/tests/application/splunk_rce_via_splunk_secure_gateway__splunk_mobile_alerts_feature.test.yml @@ -8,7 +8,7 @@ tests: attack_data: - file_name: splunk_rce_via_secure_gateway_splunk_mobile_alerts_feature.txt data: https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1210/splunk/splunk_rce_via_secure_gateway_splunk_mobile_alerts_feature.txt - source: /opt/splunk/var/log/splunk/web_access.log - sourcetype: access_combined_wcookie + source: /opt/splunk/var/log/splunk/splunkd_access.log + sourcetype: splunkd_access custom_index: _internal update_timestamp: true diff --git a/tests/application/splunk_reflected_xss_in_the_templates_lists_radio.test.yml b/tests/application/splunk_reflected_xss_in_the_templates_lists_radio.test.yml index 369abb8345..7f36ef2fd2 100644 --- a/tests/application/splunk_reflected_xss_in_the_templates_lists_radio.test.yml +++ b/tests/application/splunk_reflected_xss_in_the_templates_lists_radio.test.yml @@ -9,6 +9,6 @@ tests: - file_name: splunk_reflected_xss_in_templates_lists_radio.txt data: https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1189/splunk/splunk_reflected_xss_in_templates_lists_radio.txt source: /opt/splunk/var/log/splunk/web_access.log - sourcetype: access_combined_wcookie + sourcetype: splunk_web_access custom_index: _internal update_timestamp: true diff --git a/tests/application/splunk_stored_xss_via_data_model_objectname_field.test.yml b/tests/application/splunk_stored_xss_via_data_model_objectname_field.test.yml index 0eb87e5c5b..9573001034 100644 --- a/tests/application/splunk_stored_xss_via_data_model_objectname_field.test.yml +++ b/tests/application/splunk_stored_xss_via_data_model_objectname_field.test.yml @@ -9,6 +9,6 @@ tests: - file_name: splunk_stored_xss_via_data_model_objectname_field.txt data: https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1189/splunk/splunk_stored_xss_via_data_model_objectname_field.txt source: /opt/splunk/var/log/splunk/web_access.log - sourcetype: access_combined_wcookie + sourcetype: splunk_web_access custom_index: _internal update_timestamp: true From 9cf9d1d3f71982341cbf2fc36d970b0c7804d954 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Wed, 1 Feb 2023 17:59:02 -0800 Subject: [PATCH 4/5] Fixing incorrect macro in a detection whose test file was updated. --- ..._via_splunk_secure_gateway__splunk_mobile_alerts_feature.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/application/splunk_rce_via_splunk_secure_gateway__splunk_mobile_alerts_feature.yml b/detections/application/splunk_rce_via_splunk_secure_gateway__splunk_mobile_alerts_feature.yml index 4d09cc9bb8..4947e983e1 100644 --- a/detections/application/splunk_rce_via_splunk_secure_gateway__splunk_mobile_alerts_feature.yml +++ b/detections/application/splunk_rce_via_splunk_secure_gateway__splunk_mobile_alerts_feature.yml @@ -6,7 +6,7 @@ author: Rod Soto type: Hunting datamodel: [] description: This hunting search provides information on possible exploitation attempts against Splunk Secure Gateway App Mobile Alerts feature in Splunk versions 9.0, 8.2.x, 8.1.x. An authenticated user can run arbitrary operating system commands remotely through the use of specially crafted requests to the mobile alerts feature in the Splunk Secure Gateway app. -search: '`splunkd_webx` uri_path="/servicesNS/nobody/splunk_secure_gateway/storage/collections/data/mobile_alerts*" sort="notification.created_at:-1" | table clientip file host method uri_query sort | `splunk_rce_via_splunk_secure_gateway__splunk_mobile_alerts_feature_filter`' +search: '`splunkda` uri_path="/servicesNS/nobody/splunk_secure_gateway/storage/collections/data/mobile_alerts*" sort="notification.created_at:-1" | table clientip file host method uri_query sort | `splunk_rce_via_splunk_secure_gateway__splunk_mobile_alerts_feature_filter`' how_to_implement: This search only applies if Splunk Mobile Gateway is deployed in the vulnerable Splunk versions. known_false_positives: This detection does not require you to ingest any new data. The detection does require the ability to search the _internal index. Focus of this search is "uri_path=/servicesNS/nobody/splunk_secure_gateway/storage/collections/data/mobile_alerts*" which is the injection point. references: From 0daa31c481d7f1821831fa77a405faa78d460dc2 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Wed, 1 Feb 2023 18:01:19 -0800 Subject: [PATCH 5/5] Updated the macro in another search whose test file was changed. --- .../splunk_xss_in_save_table_dialog_header_in_search_page.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/application/splunk_xss_in_save_table_dialog_header_in_search_page.yml b/detections/application/splunk_xss_in_save_table_dialog_header_in_search_page.yml index a9f2d2ae55..21da0f28de 100644 --- a/detections/application/splunk_xss_in_save_table_dialog_header_in_search_page.yml +++ b/detections/application/splunk_xss_in_save_table_dialog_header_in_search_page.yml @@ -6,7 +6,7 @@ author: Rod Soto type: Hunting datamodel: [] description: This is a hunting search to find persistent cross-site scripting XSS code that was included while inputing data in 'Save Table' dialog in Splunk Enterprise (8.1.12,8.2.9,9.0.2). A remote user with "power" Splunk role can store this code that can lead to persistent cross site scripting. -search: '`splunkda` method=POST uri=/en-US/splunkd/__raw/servicesNS/nobody/search/datamodel/model | table _time host status clientip user uri | `splunk_xss_in_save_table_dialog_header_in_search_page_filter`' +search: '`splunkd_webx` method=POST uri=/en-US/splunkd/__raw/servicesNS/nobody/search/datamodel/model | table _time host status clientip user uri | `splunk_xss_in_save_table_dialog_header_in_search_page_filter`' how_to_implement: Watch for POST requests combined with XSS script strings or obfuscation against the injection point /en-US/splunkd/__raw/servicesNS/nobody/search/datamodel/model. known_false_positives: If host is vulnerable and XSS script strings are inputted they will show up in search. Not all Post requests are malicious as they will show when users create and save dashboards. This search may produce several results with non malicious POST requests. Only affects Splunk Web enabled instances. references: