gchq / gchq/CyberChef

CyberChef for Splunk SyntaxError: Unexpected token import

Open
#1,247 1 comment 1 reaction 0 assignees View on GitHub
bug
Dominant language
JavaScript
Stars
35.8k
Forks
4.1k
Avg merge
2d 26m
Merged PRs (30d)
33

Description

**Describe the bug**
Please excuse my lack of experience if this is my fault and not a real bug, but I was hoping someone with more knowledge than me could tell me what I'm doing wrong or if this is a bug.

**To Reproduce**
Default installation of Snort3, Splunk Enterprise, and CyberChef for Splunk + splunk3 json alerts. I'm following the Ubuntu documentation from the snort3 website to the T(https://snort-org-site.s3.amazonaws.com/production/document_files/files/000/008/108/original/Snort_3_on_Ubuntu_18_and_20.pdf)

**Expected behaviour**
A table with base64 decoded values. The search is pretty standard simple stuff, copied exactly from documentation/your github.

**sourcetype="snort3:alert:json" dest_port=80 | cyberchef infield='b64_data' outfield=decrypted operation="FromBase64" | table src_addr, dst_addr, rule, msg, decrypted**

It works fine without the cyberchef part but I need that to convert my payload to human readable format. I thought it might be an issue with empty b64_data fields so I also tried filtering out empty fields but no luck.

**Desktop (if relevant, please complete the following information):**
Ubuntu 20, chrome

I set debug to info and grabbed the search log from my failed search, it appears to be a datatype issue with a variable called kvpairs(key value pairs?).

```
09-21-2021 12:14:05.242 INFO UnifiedSearch [142440 searchOrchestrator] - Expanded index search = sourcetype="snort3:alert:json"
09-21-2021 12:14:05.242 INFO UnifiedSearch [142440 searchOrchestrator] - Expanded filtering search = (sourcetype="snort3:alert:json" dest_port=80)
09-21-2021 12:14:05.242 INFO UnifiedSearch [142440 searchOrchestrator] - base lispy: [ AND sourcetype::snort3:alert:json ]
09-21-2021 12:14:05.243 INFO UnifiedSearch [142440 searchOrchestrator] - Processed search targeting arguments
09-21-2021 12:14:05.243 INFO ChunkedExternProcessor [142440 searchOrchestrator] - Running process: /opt/splunk/bin/node /opt/splunk/etc/apps/cyberchef/bin/cyberchef.js
**09-21-2021 12:14:05.287 ERROR ChunkedExternProcessor [142461 ChunkedExternProcessorStderrLogger] - stderr: /opt/splunk/etc/apps/cyberchef/bin/cyberchef.js:129
09-21-2021 12:14:05.287 ERROR ChunkedExternProcessor [142461 ChunkedExternProcessorStderrLogger] - stderr: for(var i = 0; i < kvPairs.length; i++){
09-21-2021 12:14:05.287 ERROR ChunkedExternProcessor [142461 ChunkedExternProcessorStderrLogger] - stderr: ^
09-21-2021 12:14:05.287 ERROR ChunkedExternProcessor [142461 ChunkedExternProcessorStderrLogger] - stderr: TypeError: Cannot read property 'length' of undefined**
09-21-2021 12:14:05.287 ERROR ChunkedExternProcessor [142461 ChunkedExternProcessorStderrLogger] - stderr: at getinfo_reply (/opt/splunk/etc/apps/cyberchef/bin/cyberchef.js:129:29)
09-21-2021 12:14:05.287 ERROR ChunkedExternProcessor [142461 ChunkedExternProcessorStderrLogger] - stderr: at Socket.process.stdin.on (/opt/splunk/etc/apps/cyberchef/bin/cyberchef.js:517:15)
09-21-2021 12:14:05.287 ERROR ChunkedExternProcessor [142461 ChunkedExternProcessorStderrLogger] - stderr: at emitNone (events.js:106:13)
09-21-2021 12:14:05.287 ERROR ChunkedExternProcessor [142461 ChunkedExternProcessorStderrLogger] - stderr: at Socket.emit (events.js:208:7)
09-21-2021 12:14:05.287 ERROR ChunkedExternProcessor [142461 ChunkedExternProcessorStderrLogger] - stderr: at emitReadable_ (_stream_readable.js:513:10)
09-21-2021 12:14:05.287 ERROR ChunkedExternProcessor [142461 ChunkedExternProcessorStderrLogger] - stderr: at emitReadable (_stream_readable.js:507:7)
09-21-2021 12:14:05.287 ERROR ChunkedExternProcessor [142461 ChunkedExternProcessorStderrLogger] - stderr: at addChunk (_stream_readable.js:274:7)
09-21-2021 12:14:05.287 ERROR ChunkedExternProcessor [142461 ChunkedExternProcessorStderrLogger] - stderr: at readableAddChunk (_stream_readable.js:246:13)
09-21-2021 12:14:05.287 ERROR ChunkedExternProcessor [142461 ChunkedExternProcessorStderrLogger] - stderr: at Socket.Readable.push (_stream_readable.js:208:10)
09-21-2021 12:14:05.287 ERROR ChunkedExternProcessor [142461 ChunkedExternProcessorStderrLogger] - stderr: at Pipe.onread (net.js:601:20)
09-21-2021 12:14:05.288 ERROR ChunkedExternProcessor [142440 searchOrchestrator] - EOF while attempting to read transport header read_size=0
09-21-2021 12:14:05.288 ERROR ChunkedExternProcessor [142440 searchOrchestrator] - Error in 'cyberchef' command: External search command exited unexpectedly with non-zero error code 1.
09-21-2021 12:14:05.289 ERROR SearchPhaseGenerator [142440 searchOrchestrator] - Fallback to two phase search failed:Error in 'cyberchef' command: External search command exited unexpectedly with non-zero error code 1.
09-21-2021 12:14:05.289 ERROR SearchStatusEnforcer [142440 searchOrchestrator] - sid:1632251645.39 Error in 'cyberchef' command: External search command exited unexpectedly with non-zero error code 1.
09-21-2021 12:14:05.289 INFO SearchStatusEnforcer [142440 searchOrchestrator] - **State changed to FAILED due to: Error in 'cyberchef' command: External search command exited unexpectedly with non-zero error code 1.**
```

![Capture](https://user-images.githubusercontent.com/14339734/134236786-20513a47-1085-430c-adc9-b03e8b1d4205.PNG)

Contributor guide

Open the contributing guide

Research direction

Start with bin/cyberchef.js, especially getinfo_reply around line 129, and reproduce the documented cyberchef search in a Splunk installation using the supplied Snort3 alert data. Trace why kvPairs is undefined, then verify that the search completes and produces the expected base64-decoded table without the external-command error.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, node.js
Domain
backend, tooling
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.