Description

In versions below 2.3.8 of the AD LDAP app for Splunk SOAR, a user who holds a role with permission to run actions could inject crafted input into an Active Directory query to enumerate Active Directory objects, including accounts, groups, and organizational units, read sensitive attributes from arbitrary directory objects, and redirect account modification actions to unintended objects. For more information see Run an action in Splunk SOAR (https://help.splunk.com/en/splunk-soar/soar-on-premises/use-splunk-soar-on-premises/8.6.0/use-the-command-line-interface-to-perform-tasks-in-splunk-soar-on-premises/run-an-action-in-splunk-soar-on-premises).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-08-19T22:17:23.187Z",
  "pubdate": "2026-08-19T22:17:23.187Z",
  "executiveSummary": "A vulnerability exists in the AD LDAP app for Splunk SOAR in versions below 2.3.8, involving improper neutralization of user-supplied input within Active Directory queries. This security flaw allows an authenticated user holding a role with permissions to run actions to inject crafted input into LDAP query strings.\nThe impact of this vulnerability encompasses unauthorized information disclosure and modification redirection. Specifically, a malicious actor can enumerate sensitive Active Directory objects, including user accounts, security groups, and organizational units, as well as read sensitive attributes from arbitrary directory objects. Furthermore, the vulnerability enables the redirection of account modification actions to unintended objects within the directory structure.\nThe affected product is the AD LDAP app for Splunk SOAR across all versions prior to 2.3.8. Exploitation requires the attacker to possess specific authentication and authorization privileges—specifically, holding a role within Splunk SOAR that grants permission to execute actions.\nThe risk implications are significant for enterprise security architectures, as unauthorized enumeration and attribute harvesting expose critical directory metadata, while modified action targets compromise the integrity of identity management workflows.",
  "technicalDetails": "The root cause of the vulnerability stems from insufficient input sanitization and parameterization within the AD LDAP app for Splunk SOAR query construction logic. When a user with action-execution privileges supplies input destined for Active Directory search or modification routines, the application fails to adequately neutralize special characters or syntactic constructs native to the Lightweight Directory Access Protocol (LDAP).\nThe vulnerable component is the query generation and execution engine of the AD LDAP app for Splunk SOAR in versions below 2.3.8. Authentication and authorization requirements mandate that the attacker must be authenticated to the Splunk SOAR platform and assigned a role that explicitly holds permissions to execute integration actions.\nThe attack flow proceeds in a step-by-step manner. First, the authenticated user identifies an action within the AD LDAP app interface that accepts parameters destined for Active Directory queries. Second, the user crafts a malicious payload incorporating LDAP filter metacharacters, such as parentheses or logical operators, designed to alter the logical structure of the underlying query. Third, the user submits the crafted input through the Splunk SOAR action execution interface.\nUpon receiving the input, the vulnerable application concatenates the unsanitized payload directly into the LDAP query string without robust escaping or schema validation. When the query is executed against the target Active Directory domain controller, the directory server interprets the injected syntax as part of the query logic. This allows the attacker to break out of the intended query boundaries, facilitating unauthorized object enumeration, extraction of sensitive attributes from arbitrary directory objects, and the manipulation of target parameters to redirect account modification actions to unintended AD entities.\nThe post-exploitation impact includes the systematic harvesting of internal directory topology, discovery of privileged user accounts and groups, and the potential manipulation of unauthorized objects if modification capabilities are successfully redirected."
}