U.S. Dept Of Defense: Splunk Sensitive Information Disclosure @████████

Hi Team,

Hope you are doing great.
I got a domain that contains Splunk Sensitive Information Disclosure @██████████
PoC:
https://███████/en-US/splunkd/__raw/services/server/info/server-info?output_mode=json
█████████

Splunk through 7.0.1 allows information disclosure by appending __raw/services/server/info/server-info?output_mode=json to a query, as demonstrated by discovering a license key.

Reference:
- https://nvd.nist.gov/vuln/detail/CVE-2018-11409
- https://github.com/kofa2002/splunk
- https://www.exploit-db.com/exploits/44865/
- http://web.archive.org/web/20211208114213/https://securitytracker.com/id/1041148

Impact

Splunk Sensitive Information Disclosure

System Host(s)

██████

Affected Product(s) and Version(s)

CVE Numbers

Steps to Reproduce

Open this link:
https://█████████/en-US/splunkd/__raw/services/server/info/server-info?output_mode=json

Suggested Mitigation/Remediation Actions