This is my first survey, hopefully it will be answered 
Hi Splunk #Admins out there, if you setup an #onpremise Splunk enterprise server, do you already know that additional #hardening is required?
Especially that you have to create your own `/opt/splunk/etc/system/local/inputs.conf` file with blacklist entries for local files or directories, to protect against local file inclusion attacks?
/etc/passwd
/proc/net/arp (to spy internal network details)
/old splunk version installation directories/etc/passwd
....
Otherwise a very simple #LFI #vulnerability in default #Splunk installation is possible. Fortunately with role splunk-system-role or admin only and not low privileged user.
Splunk states if someone has system or admin role, he can do anything.
Do you know about required hardening with `inputs.conf` (https://docs.splunk.com/Documentation/Splunk/9.3.1/Admin/Inputsconf)?
Can a Splunk admin/system role edit `inputs.conf` via WebUI or its endpoints?
I did not check in detail and did not found any reference for it.
Have your Splunk users with admin/system roles #SSH access to the OS too, to modify files locally?
I this an issue for you?
Turn your phone horizontally to read the full entries: