Description

In versions below 2.1.9 of the AWS IAM app for Splunk SOAR, a user who holds a role with permission to run actions could expose sensitive AWS credentials by invoking an action that accepts the credentials parameter, because the parameter is not masked and is shown in cleartext in the user interface. The information disclosure is possible because the app does not mark the affected action parameter as a password. For more information see Run an action in Splunk SOAR (https://help.splunk.com/en/splunk-soar/soar-on-premises/use-splunk-soar-on-premises/8.6.0/use-the-command-line-interface-to-perform-tasks-in-splunk-soar-on-premises/run-an-action-in-splunk-soar-on-premises).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-19T22:17:23.577Z",
  "pubdate": "2026-08-19T22:17:23.577Z",
  "executiveSummary": "An information disclosure vulnerability exists in versions below 2.1.9 of the AWS IAM app for Splunk SOAR.\nThe vulnerability allows a user who holds a role with permission to run actions to expose sensitive AWS credentials in cleartext within the user interface.\nThis occurs because the affected action parameter accepts sensitive credentials but is not marked as a password type, preventing proper masking by the application.\nThe risk implication involves unauthorized exposure of sensitive authentication material to users with standard action-execution privileges.\nAttacker capabilities include viewing cleartext credentials directly through the user interface during action invocation.\nExploitation requires the attacker or user to hold a role with permissions to run actions and invoke an action that accepts the credentials parameter.",
  "technicalDetails": "The root cause of the information disclosure vulnerability is the failure of the AWS IAM app for Splunk SOAR to properly designate the credentials parameter as a password type within its metadata configuration.\nBecause the parameter is not masked as a password, input values provided during action execution are rendered in cleartext within the user interface.\nThe vulnerable component is the action parameter handling mechanism within the AWS IAM app for Splunk SOAR, specifically affecting versions below 2.1.9.\nAuthentication and privilege requirements dictate that the user must hold a role explicitly granted permission to run actions within the Splunk SOAR environment.\nNetwork exposure is localized to the Splunk SOAR platform user interface where the action parameters are rendered and displayed to the user.\nThe step-by-step attack flow involves the following: First, a user with permissions to execute actions initiates an action that accepts the credentials parameter. Second, the user inputs sensitive AWS credentials into the parameter field. Third, due to the missing password classification, the application fails to mask the input. Fourth, the sensitive AWS credentials are exposed in cleartext within the user interface.\nThe post-exploitation impact includes the unauthorized extraction of sensitive AWS credentials by users or compromised accounts with action-execution privileges, potentially leading to further unauthorized access and lateral movement within the connected AWS environment."
}