CyberChef for Splunk SyntaxError: Unexpected token import
- Dominant language
- JavaScript
- Stars
- 35.8k
- Forks
- 4.1k
- Avg merge
- 2d 26m
- Merged PRs (30d)
- 33
Description
**Describe the bug**
Please excuse my lack of experience if this is my fault and not a real bug, but I was hoping someone with more knowledge than me could tell me what I'm doing wrong or if this is a bug.
**To Reproduce**
Default installation of Snort3, Splunk Enterprise, and CyberChef for Splunk + splunk3 json alerts. I'm following the Ubuntu documentation from the snort3 website to the T(https://snort-org-site.s3.amazonaws.com/production/document_files/files/000/008/108/original/Snort_3_on_Ubuntu_18_and_20.pdf)
**Expected behaviour**
A table with base64 decoded values. The search is pretty standard simple stuff, copied exactly from documentation/your github.
**sourcetype="snort3:alert:json" dest_port=80 | cyberchef infield='b64_data' outfield=decrypted operation="FromBase64" | table src_addr, dst_addr, rule, msg, decrypted**
It works fine without the cyberchef part but I need that to convert my payload to human readable format. I thought it might be an issue with empty b64_data fields so I also tried filtering out empty fields but no luck.
**Desktop (if relevant, please complete the following information):**
Ubuntu 20, chrome
I set debug to info and grabbed the search log from my failed search, it appears to be a datatype issue with a variable called kvpairs(key value pairs?).
```
09-21-2021 12:14:05.242 INFO UnifiedSearch [142440 searchOrchestrator] - Expanded index search = sourcetype="snort3:alert:json"
09-21-2021 12:14:05.242 INFO UnifiedSearch [142440 searchOrchestrator] - Expanded filtering search = (sourcetype="snort3:alert:json" dest_port=80)
09-21-2021 12:14:05.242 INFO UnifiedSearch [142440 searchOrchestrator] - base lispy: [ AND sourcetype::snort3:alert:json ]
09-21-2021 12:14:05.243 INFO UnifiedSearch [142440 searchOrchestrator] - Processed search targeting arguments
09-21-2021 12:14:05.243 INFO ChunkedExternProcessor [142440 searchOrchestrator] - Running process: /opt/splunk/bin/node /opt/splunk/etc/apps/cyberchef/bin/cyberchef.js
**09-21-2021 12:14:05.287 ERROR ChunkedExternProcessor [142461 ChunkedExternProcessorStderrLogger] - stderr: /opt/splunk/etc/apps/cyberchef/bin/cyberchef.js:129
09-21-2021 12:14:05.287 ERROR ChunkedExternProcessor [142461 ChunkedExternProcessorStderrLogger] - stderr: for(var i = 0; i < kvPairs.length; i++){
09-21-2021 12:14:05.287 ERROR ChunkedExternProcessor [142461 ChunkedExternProcessorStderrLogger] - stderr: ^
09-21-2021 12:14:05.287 ERROR ChunkedExternProcessor [142461 ChunkedExternProcessorStderrLogger] - stderr: TypeError: Cannot read property 'length' of undefined**
09-21-2021 12:14:05.287 ERROR ChunkedExternProcessor [142461 ChunkedExternProcessorStderrLogger] - stderr: at getinfo_reply (/opt/splunk/etc/apps/cyberchef/bin/cyberchef.js:129:29)
09-21-2021 12:14:05.287 ERROR ChunkedExternProcessor [142461 ChunkedExternProcessorStderrLogger] - stderr: at Socket.process.stdin.on (/opt/splunk/etc/apps/cyberchef/bin/cyberchef.js:517:15)
09-21-2021 12:14:05.287 ERROR ChunkedExternProcessor [142461 ChunkedExternProcessorStderrLogger] - stderr: at emitNone (events.js:106:13)
09-21-2021 12:14:05.287 ERROR ChunkedExternProcessor [142461 ChunkedExternProcessorStderrLogger] - stderr: at Socket.emit (events.js:208:7)
09-21-2021 12:14:05.287 ERROR ChunkedExternProcessor [142461 ChunkedExternProcessorStderrLogger] - stderr: at emitReadable_ (_stream_readable.js:513:10)
09-21-2021 12:14:05.287 ERROR ChunkedExternProcessor [142461 ChunkedExternProcessorStderrLogger] - stderr: at emitReadable (_stream_readable.js:507:7)
09-21-2021 12:14:05.287 ERROR ChunkedExternProcessor [142461 ChunkedExternProcessorStderrLogger] - stderr: at addChunk (_stream_readable.js:274:7)
09-21-2021 12:14:05.287 ERROR ChunkedExternProcessor [142461 ChunkedExternProcessorStderrLogger] - stderr: at readableAddChunk (_stream_readable.js:246:13)
09-21-2021 12:14:05.287 ERROR ChunkedExternProcessor [142461 ChunkedExternProcessorStderrLogger] - stderr: at Socket.Readable.push (_stream_readable.js:208:10)
09-21-2021 12:14:05.287 ERROR ChunkedExternProcessor [142461 ChunkedExternProcessorStderrLogger] - stderr: at Pipe.onread (net.js:601:20)
09-21-2021 12:14:05.288 ERROR ChunkedExternProcessor [142440 searchOrchestrator] - EOF while attempting to read transport header read_size=0
09-21-2021 12:14:05.288 ERROR ChunkedExternProcessor [142440 searchOrchestrator] - Error in 'cyberchef' command: External search command exited unexpectedly with non-zero error code 1.
09-21-2021 12:14:05.289 ERROR SearchPhaseGenerator [142440 searchOrchestrator] - Fallback to two phase search failed:Error in 'cyberchef' command: External search command exited unexpectedly with non-zero error code 1.
09-21-2021 12:14:05.289 ERROR SearchStatusEnforcer [142440 searchOrchestrator] - sid:1632251645.39 Error in 'cyberchef' command: External search command exited unexpectedly with non-zero error code 1.
09-21-2021 12:14:05.289 INFO SearchStatusEnforcer [142440 searchOrchestrator] - **State changed to FAILED due to: Error in 'cyberchef' command: External search command exited unexpectedly with non-zero error code 1.**
```

Contributor guide
Research direction
Start with bin/cyberchef.js, especially getinfo_reply around line 129, and reproduce the documented cyberchef search in a Splunk installation using the supplied Snort3 alert data. Trace why kvPairs is undefined, then verify that the search completes and produces the expected base64-decoded table without the external-command error.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, node.js
- Domain
- backend, tooling
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100