Executive Summary

In Splunk Add-on for Palo Alto Networks versions below 2.0.2, client secrets are exposed in plain text within the _internal index when adding new Data Security Accounts. This exposure requires either local access to log files or administrative access to internal indexes, which are typically restricted to admin roles.

Useful 0 Not Useful 0

Impact Analysis

If an attacker gains local access to log files or administrative access to internal indexes, they could obtain client secrets in plain text. This could lead to unauthorized access or misuse of those secrets, potentially compromising security.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by reviewing the _internal index logs in Splunk for exposed client secrets related to the addition of new Data Security Accounts. Since the issue involves client secrets being stored in plain text in the _internal index, you can search the internal logs for sensitive information patterns. Specific commands are not provided in the available information.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include reviewing roles and capabilities on your Splunk instance and restricting access to the _internal index to administrator-level roles only. Ensure that only trusted admin roles have access to internal indexes to prevent exposure of client secrets. Additionally, upgrade the Splunk Add-on for Palo Alto Networks to version 2.0.2 or later where this vulnerability is fixed.

Useful 0 Not Useful 0