AppInspect App for Splunk

# Important Notice # **Our team recently discovered security vulnerabilities in this app that have been fixed in version 2.2.0.** # What You Need to Know # We discovered a directory traversal vulnerability in the AppInspect App for Splunk, which affects the upload endpoint in the application. This could essentially allow attackers to access restricted directories and execute commands. Additionally, a SSRF vulnerability was found. In order to take advantage of these vulnerabilities, the user would need to have successfully authenticated to the Splunk instance. Both of these issues have been resolved. Please note that this affects **all versions** of the AppInspect App for Splunk app **prior to version 2.2.0**. # Recommended Course of Action # If you have the app installed on any non-local machines, it is recommended to remove or update the AppInspect App for Splunk as soon as possible. ------------------------------------------------------------------------------------------------------------------------------------ # Why an app for AppInspect? (So Meta) # An easy way to send your Splunk Apps to AppInspect's API. # Who is this app for? # - Anyone who builds Splunk apps. The goal is to make the process easier as well as making sure you are always validating your app against the newest version of AppInspect. # How does the app work? # - This app works with the https://api.splunk.com REST API - Your .tar.gz or .tgz file will be uploaded into this app's local directory and then removed once it has been sent to AppInspect for validation. - Only the most recently generated AppInspect report is kept on disk. A copy of this is located in the app's local/reports/ directory # Steps to use: # 1. Login using your Splunk credentials 2. Click or drag and drop on the file drop area (must be a tar.gz/.tgz) 3. Modify settings to fit your specific needs 4. Wait for results 5. Success! Download a copy of the report in the browser