Splunk Authentication Token Exposure in Debug Log

name: Splunk Authentication Token Exposure in Debug Log
id: 9a67e749-d291-40dd-8376-d422e7ecf8b5
version: 9
creation_date: '2024-03-27'
modification_date: '2026-06-24'
author: Rod Soto, Chase Franklin
status: production
type: TTP
description: |-
    The following analytic identifies exposed authentication tokens in debug logs within Splunk Enterprise.
    It leverages logs from the `splunkd` component with a DEBUG log level, specifically searching for event messages that validate tokens. This activity is significant because exposed tokens can be exploited by attackers to gain unauthorized access to the Splunk environment.
    If confirmed malicious, this exposure could lead to unauthorized data access, privilege escalation, and potential compromise of the entire Splunk infrastructure.
    Monitoring and addressing this vulnerability is crucial for maintaining the security and integrity of the Splunk deployment.
data_source: []
search: |-
    `splunkd`
    component=JsonWebToken
    log_level=DEBUG
    eventtype="splunkd-log"
    event_message="Validating token:*"
    | rex "Validating token: (?<token>.*)\.$"
    | search token!=None
    | stats count min(_time) as firstTime
                  max(_time) as lastTime
                  values(log_level) as log_level
                  values(event_message) as event_message
      by index, sourcetype, host, token
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `splunk_authentication_token_exposure_in_debug_log_filter`
how_to_implement: Requires access to internal Splunk indexes.
known_false_positives: Only applies to affected versions of Splunk Enterprise below 9.2.1, 9.1.4, and 9.0.9
references:
    - https://advisory.splunk.com/advisories/SVD-2024-0301
drilldown_searches:
    - name: View the detection results for $host$
      search: '%original_detection_search% | search  host = $host$'
      earliest_offset: $info_min_time$
      latest_offset: $info_max_time$
    - name: View risk events for the last 7 days for $host$
      search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ($host$) starthoursago=168 endhoursago=1 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
      earliest_offset: $info_min_time$
      latest_offset: $info_max_time$
finding:
    title: Possible JsonWebToken exposure, please investigate affected $host$
    entity:
        field: host
        type: system
        score: 50
analytic_story:
    - Splunk Vulnerabilities
asset_type: Splunk Server
cve:
    - CVE-2024-29945
mitre_attack_id:
    - T1654
product:
    - Splunk Enterprise
    - Splunk Cloud
    - Splunk Enterprise Security
category: application
security_domain: endpoint
tests:
    - name: True Positive Test
      attack_data:
        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1654/splunk/jsonwebtokenplaintokensvd_splunkd.log
          source: /opt/splunk/var/log/splunk/splunkd.log
          sourcetype: splunkd
          index: _internal
      test_type: unit