Description

In versions below 2.4.5 of the Cisco Secure Malware Analytics app for Splunk SOAR, a user who holds a role with permission to run actions could expose a sensitive sample password by invoking the detonate file action, because the action's sample_password parameter is not masked and is shown in cleartext in the user interface. The information disclosure is possible because the app does not mark the affected action parameter as a password. For more information see Run an action in Splunk SOAR (https://help.splunk.com/en/splunk-soar/soar-on-premises/use-splunk-soar-on-premises/8.6.0/use-the-command-line-interface-to-perform-tasks-in-splunk-soar-on-premises/run-an-action-in-splunk-soar-on-premises).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-19T22:17:23.823Z",
  "pubdate": "2026-08-19T22:17:23.823Z",
  "executiveSummary": "An information disclosure vulnerability exists in versions below 2.4.5 of the Cisco Secure Malware Analytics app for Splunk SOAR.\nThe vulnerability arises due to the improper handling of sensitive parameter fields within application actions, specifically failing to mask the sample_password parameter during execution.\nThis flaw allows authenticated users who possess permissions to run actions to view sensitive sample passwords in cleartext directly within the user interface.\nThe risk implication involves the unauthorized exposure of confidential authentication credentials or decryption keys associated with malware samples being detonated.\nAttacker capabilities are constrained to users who already hold valid roles with permissions to execute SOAR actions, requiring no complex exploitation techniques beyond standard application usage.\nImpacted systems include deployments of the Cisco Secure Malware Analytics app for Splunk SOAR running vulnerable versions below 2.4.5.",
  "technicalDetails": "The root cause of this vulnerability is the failure of the application to properly designate the sample_password parameter as a password type within the action configuration schema.\nIn Splunk SOAR, input parameters defined as passwords are automatically obfuscated and masked within the graphical user interface to prevent visual exposure of sensitive data.\nBecause the Cisco Secure Malware Analytics app omits this classification for the sample_password parameter, the cleartext value entered by the operator is rendered visibly in the user interface upon invoking the detonate file action.\nThe affected component is the detonate file action within the Cisco Secure Malware Analytics app for Splunk SOAR for versions below 2.4.5.\nAuthentication and privilege requirements dictate that the user must hold a specific role with permissions to run actions within the Splunk SOAR platform, meaning the attack vector is localized to authorized internal users or compromised accounts with sufficient operational privileges.\nThe attack flow proceeds as follows: 1) An authorized user navigates to the action execution interface in Splunk SOAR; 2) The user or a preceding automated workflow populates the detonate file action parameters, including the sensitive sample_password; 3) Upon execution or inspection of the action logs and interface elements, the sample_password parameter is displayed in plaintext; 4) Any observer with interface access can extract the sensitive credential.\nPost-exploitation impact includes the potential reuse of exposed sample passwords to access encrypted archives, secure file shares, or restricted malware payloads, potentially leading to secondary compromise or unauthorized data access within connected environments."
}