Description

In versions below 2.3.8 of the AD LDAP app for Splunk SOAR, a user who holds a role with permission to run actions could cause sensitive Active Directory response data to be written to a persistent debug log file by triggering write operations through the app. For more information see Run an action in Splunk SOAR (https://help.splunk.com/en/splunk-soar/soar-on-premises/use-splunk-soar-on-premises/8.6.0/use-the-command-line-interface-to-perform-tasks-in-splunk-soar-on-premises/run-an-action-in-splunk-soar-on-premises).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-19T22:17:23.323Z",
  "pubdate": "2026-08-19T22:17:23.323Z",
  "executiveSummary": "An information disclosure vulnerability has been identified in versions below 2.3.8 of the AD LDAP app for Splunk SOAR.\nThe vulnerability allows a user with permissions to execute actions to inadvertently or intentionally cause sensitive Active Directory response data to be written directly to a persistent debug log file.\nThis introduces significant risk implications regarding credential material, directory structures, and sensitive enterprise metadata being exposed within local storage files that may lack proper restrictive access controls.\nThe attacker capabilities require the user to already hold a specific role with permissions to run actions within the affected Splunk SOAR platform.\nExploitation is driven by triggering specific write operations through the AD LDAP app, which forces the verbose output containing confidential LDAP query responses to persist inside debugging logs.\nAffected systems are restricted to deployments utilizing vulnerable versions of the AD LDAP app for Splunk SOAR, requiring immediate administrative attention and remediation to prevent unauthorized data exposure.",
  "technicalDetails": "The root cause of this information disclosure vulnerability stems from insecure logging practices within the AD LDAP app for Splunk SOAR in versions below 2.3.8.\nWhen a user holding a role with sufficient privileges to run actions triggers write operations through the application, the underlying execution logic outputs extensive debugging information.\nInstead of sanitizing or omitting confidential attributes, the application writes sensitive Active Directory response data directly into a persistent debug log file.\nThe vulnerable component is the logging and action-execution routine of the AD LDAP app.\nAuthentication and authorization requirements dictate that the executing entity must possess a role configured with permissions to run actions inside Splunk SOAR, meaning this is an abuse-of-functionality vector leveraging authenticated privileges rather than an unauthenticated remote code execution.\nThe attack flow proceeds as follows: First, an authenticated user with action-execution privileges initiates a write operation targeting the AD LDAP integration. Second, the AD LDAP app processes the command and interacts with the target Active Directory environment. Third, the application generates a verbose debug trace containing sensitive LDAP payload responses returned from the directory server. Fourth, the application writes this unmasked response data into the persistent debug log file on the local file system. Finally, any user or process with read access to the persistent debug log file can harvest the sensitive Active Directory information, leading to post-exploitation risks such as reconnaissance data aggregation and credential harvesting."
}