rules-splunk

Potentially unsafe pattern detected in splunk code: "SPLUNK_HEC_TOKEN". Review the use case — this may indicate a security risk, a deprecated API, or a misconfiguration. Confirm the write is intentional.

RISK: A hardcoded Splunk HEC token in source allows anyone with repo access to ingest arbitrary events into your indexes, potentially causing data pollution or log injection attacks. FIX: Read the token from an environment variable or a secrets manager at runtime; never commit it.

RISK: Splunk .conf files with hardcoded passwords are checked into version control and readable by anyone with file access — including old git history. FIX: Use Splunk's storage/passwords endpoint or Credential Storage API; reference as $CREDENTIAL$ placeholders in app configs.

RISK: Splunk script alert actions that embed $result.* field values in shell commands are a command-injection sink — a malicious event value reaches the OS shell. FIX: In the script, read field values from stdin/JSON (passed by Splunk) and validate them before use; never interpolate $result.* directly into a shell command.

RISK: Constructing a Splunk SPL search string that includes an eval command from user input is an SPL injection vector — the attacker can invoke sensitive SPL functions (e.g. makeresults, outputlookup) or exfiltrate data. FIX: Never interpolate user input into SPL; use parameterized dispatch via the Splunk REST API or token-replace only with an allowlist.

You are using an outdated API for splunk. Please upgrade to the newer API.

RISK: Exposing a Splunk search endpoint where the SPL query comes from a GET parameter allows unauthenticated callers (or CSRF) to execute arbitrary searches against your Splunk instance. FIX: Accept only POST requests for search dispatch, require auth, and validate the SPL query against an allowlist.

RISK: Granting a Splunk role access to all indexes (*) violates least-privilege — users can read security, audit, and internal indexes they should not see. FIX: Enumerate only the indexes the role needs in srchIndexesAllowed.