AppInspect App for Splunk

Overview

# Important Notice #
**Our team recently discovered security vulnerabilities in this app that have been fixed in version 2.2.0.**

# What You Need to Know #
We discovered a directory traversal vulnerability in the AppInspect App for Splunk, which affects the upload endpoint in the application. This could essentially allow attackers to access restricted directories and execute commands. Additionally, a SSRF vulnerability was found. In order to take advantage of these vulnerabilities, the user would need to have successfully authenticated to the Splunk instance.

Both of these issues have been resolved.

Please note that this affects **all versions** of the AppInspect App for Splunk app **prior to version 2.2.0**.

# Recommended Course of Action #
If you have the app installed on any non-local machines, it is recommended to remove or update the AppInspect App for Splunk as soon as possible.

------------------------------------------------------------------------------------------------------------------------------------

# Why an app for AppInspect? (So Meta) #
An easy way to send your Splunk Apps to AppInspect's API.

# Who is this app for? #
- Anyone who builds Splunk apps. The goal is to make the process easier as well as making sure you are always validating
your app against the newest version of AppInspect.

# How does the app work? #
- This app works with the https://api.splunk.com REST API
- Your .tar.gz or .tgz file will be uploaded into this app's local directory and then removed once it has been
sent to AppInspect for validation.
- Only the most recently generated AppInspect report is kept on disk. A copy of this is located in the
app's local/reports/ directory

# Steps to use: #
1. Login using your Splunk credentials
2. Click or drag and drop on the file drop area (must be a tar.gz/.tgz)
3. Modify settings to fit your specific needs
4. Wait for results
5. Success! Download a copy of the report in the browser

Release Notes

Version 2.2.0

Aug. 1, 2022

v 2.2.0

Security Patch: Fix directory traversal and SSRF vulnerability.

1,719

Downloads

Share Subscribe

Version

Built by

Hurricane Labs

Support

Developer Supported

Contact Developer Questions on Splunk Answers Flag as inappropriate

Compatibility

Products: Splunk Enterprise, Splunk Cloud

Splunk Versions: 9.0, 8.2, 8.1, 8.0

Platform: Platform Independent

Licensing

End User License Agreement for Third-Party Content

Category & Contents

Categories: Utilities

App Type: App

Subscribe Share

My Account

Support & Services