Description

In versions below 5.1.3 of the CrowdStrike OAuth API app for Splunk SOAR, a user who holds a role with permission to run actions could expose a sensitive document password by invoking either the detonate file or detonate url action, because the action's document_password parameter is not masked and is shown in cleartext in the user interface. The information disclosure is possible because the app does not mark the affected action parameter as a password. For more information see Run an action in Splunk SOAR (https://help.splunk.com/en/splunk-soar/soar-on-premises/use-splunk-soar-on-premises/8.6.0/use-the-command-line-interface-to-perform-tasks-in-splunk-soar-on-premises/run-an-action-in-splunk-soar-on-premises).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-19T22:17:24.077Z",
  "pubdate": "2026-08-19T22:17:24.077Z",
  "executiveSummary": "An information disclosure vulnerability exists in versions below 5.1.3 of the CrowdStrike OAuth API app for Splunk SOAR.\nThe vulnerability allows an authenticated user with permissions to execute actions to expose sensitive document passwords in cleartext within the user interface.\nThis occurs when invoking either the detonate file or detonate url action because the underlying document_password parameter lacks proper masking.\nThe impact includes the unauthorized exposure of sensitive authentication credentials or document passwords to any user capable of viewing the action execution details in the user interface.\nThe risk implications involve potential credential compromise and lateral exposure within the security orchestration platform.\nAttacker capabilities require local execution rights with a role possessing permissions to run actions within Splunk SOAR.\nNo external network exposure or complex exploitation requirements are necessary beyond standard user interface interaction with the affected application parameters.",
  "technicalDetails": "The root cause of the information disclosure vulnerability stems from improper handling of sensitive input parameters within the CrowdStrike OAuth API app for Splunk SOAR.\nSpecifically, the vulnerable components are the detonate file and detonate url actions, where the document_password parameter is not explicitly marked as a password type within the application configuration.\nBecause the parameter is not masked by the application framework, input supplied to document_password is rendered in cleartext in the user interface during and after action execution.\nAffected versions include all releases of the CrowdStrike OAuth API app for Splunk SOAR prior to version 5.1.3.\nAuthentication and privilege requirements dictate that the user must hold a role with explicit permissions to run actions within the Splunk SOAR environment.\nThe attack flow proceeds as follows: 1) An authenticated user with action-execution privileges initiates either the detonate file or detonate url action via the Splunk SOAR user interface. 2) The user inputs a sensitive password into the document_password parameter field. 3) Upon submission and execution, the application fails to obfuscate the parameter value due to the missing password classification. 4) The plaintext password is rendered visibly in the user interface action history and logs.\nThe post-exploitation impact includes the localized exposure of sensitive document passwords to unauthorized observers or internal users who have access to view action execution traces within the Splunk SOAR platform."
}