Description

In FireAMP versions below 2.1.15, a user who holds a role that can edit, create, or run playbooks in Splunk SOAR could run the add listitem action in a Safe Mode playbook while that action is listed as read-only, which could allow for unauthorized changes to file lists. The vulnerability is possible because the FireAMP connector action manifest classifies the add listitem action as read-only even though the action updates file lists. For more information see Manage settings for a playbook in Splunk SOAR (https://help.splunk.com/en/splunk-soar/soar-cloud/build-playbooks/manage-playbooks-and-playbook-settings/manage-settings-for-a-playbook-in-splunk-soar-cloud) in the Splunk documentation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "2.7",
  "pubDate": "2026-08-19T22:17:22.887Z",
  "pubdate": "2026-08-19T22:17:22.887Z",
  "executiveSummary": "An incorrect permission classification vulnerability exists within the FireAMP connector for Splunk SOAR in versions prior to 2.1.15. The vulnerability stems from a misclassification in the connector action manifest, which incorrectly designates the state-modifying add listitem action as a read-only operation. This flaw allows unauthorized or restricted changes to file lists within the environment when executed via a Safe Mode playbook. The impact of this security issue includes unauthorized data modification and integrity compromise of managed file lists. Exploitation requires an authenticated user who holds a role capable of editing, creating, or running playbooks within Splunk SOAR, combined with the capability to execute Safe Mode playbooks containing the misclassified action. Risk implications involve the bypassing of intended security controls and least-privilege boundaries regarding file list management. Mitigation requires updating the FireAMP connector to version 2.1.15 or later to ensure proper manifest classification and enforcement of read-only restrictions.",
  "technicalDetails": "The vulnerability is rooted in an improper authorization and metadata configuration within the FireAMP connector action manifest utilized by Splunk SOAR. Specifically, the action manifest misclassifies the state-updating add listitem action as a read-only operation, despite the function executing underlying logic that actively modifies file lists. Due to this misclassification, security controls and execution constraints that typically apply to state-modifying actions fail to restrict the execution of the add listitem action when evaluated under specific operational contexts.\nThe attack flow requires the attacker or an authorized user with specific playbook permissions to interact with Splunk SOAR playbooks. The prerequisite privileges mandate that the user holds a role capable of editing, creating, or running playbooks. Step-by-step exploitation occurs as follows: first, the actor incorporates or executes the add listitem action within a Safe Mode playbook context. Second, because the action manifest designates the component as read-only, the execution engine bypasses standard permission validation checks that would normally block users lacking explicit file list modification privileges. Third, the execution of the add listitem action triggers the update mechanism against the target file lists, resulting in unauthorized data modification.\nThe vulnerable component is the FireAMP connector integration affecting versions below 2.1.15 within the Splunk SOAR ecosystem. Authentication and privilege requirements dictate that the attacker must possess valid access to Splunk SOAR with roles permitting playbook creation, editing, or execution. Network exposure is constrained by the architecture of Splunk SOAR and the integration parameters of the FireAMP connector. Post-exploitation impact is limited to unauthorized changes to file lists, which can disrupt security operations, alter security baselines, or lead to inconsistent state management within the integrated systems."
}