Splunk Add-On for Palo Alto Networks Sensitive Information Disclosure Vulnerability

A vulnerability exists in Splunk Add-on for Palo Alto Networks versions prior to 2.0.2, where client secrets are exposed in plain text in the _internal index. This occurs during the addition of new 'Data Security Accounts'. Exploitation of this vulnerability requires either local access to the log files or administrative access to internal indexes, which is typically granted only to users with the admin role.

Impact

The vulnerability allows for the unauthorized disclosure of client secrets, which could be misused if exposed.

Remediation

Users should upgrade the Splunk Add-On for Palo Alto Networks to version 2.0.2, 3.0.0, or higher. After upgrading, it is recommended to check the _internal index for any exposed credentials and generate new client_id and client_secret as needed, revoking any that were exposed.