Product:
Splunk Enterprise
Summary
In Splunk Enterprise versions below 10.0.1, 9.4.6, 9.3.8, and 9.2.10, and Splunk Cloud Platform versions below 10.1.2507.4, 10.0.2503.6, and 9.3.2411.117.125, an unauthenticated attacker can inject ANSI escape codes into Splunk log files due to improper validation at the /en-US/static/ web endpoint. This may allow them to poison, forge, or obfuscate sensitive log data through specially crafted HTTP requests, potentially impacting log integrity and detection capabilities.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 5.3 | CVE-2025-20384 |
Exploitation
An attacker can exploit this vulnerability by sending specially crafted HTTP requests to the affected web endpoint. By injecting ANSI escape codes into the log files, the attacker can manipulate the log data, which may lead to the obfuscation or forgery of sensitive information. This exploitation does not require any authentication or user interaction, making it easier for attackers to target vulnerable systems.
Affected Products
- Splunk Enterprise versions below 10.0.1
- Splunk Enterprise versions below 9.4.6
- Splunk Enterprise versions below 9.3.8
- Splunk Enterprise versions below 9.2.10
- Splunk Cloud Platform versions below 10.1.2507.4
- Splunk Cloud Platform versions below 10.0.2503.6
- Splunk Cloud Platform versions below 9.3.2411.117.125
Mitigation
To mitigate this vulnerability, it is recommended to upgrade to the latest versions of Splunk Enterprise and Splunk Cloud Platform that are not affected by this issue. Additionally, implementing proper input validation and sanitization measures can help prevent the injection of malicious ANSI escape codes into log files.