CVE-2025-20320: Splunk Enterprise DoS Vulnerability

CVE-2025-20320 Overview

CVE-2025-20320 is a path traversal vulnerability [CWE-35] in Splunk Enterprise and Splunk Cloud Platform. A low-privileged user without the admin or power roles can craft a malicious payload through the User Interface - Views configuration page. The payload enables deletion of arbitrary files within a Splunk directory, leading to a denial of service condition. Exploitation requires the low-privileged user to phish an administrator-level victim into initiating a request from their browser. Splunk published advisory SVD-2025-0703 covering the affected versions and remediated builds.

Critical Impact
Successful exploitation enables deletion of arbitrary files within Splunk directories, causing denial of service to logging, search, and monitoring functions.

Affected Products

Splunk Enterprise versions below 9.4.3, 9.3.5, 9.2.7, and 9.1.10
Splunk Cloud Platform versions below 9.3.2411.107, 9.3.2408.117, and 9.2.2406.121
Deployments where low-privileged users have access to the User Interface - Views configuration page

Discovery Timeline

2025-07-07 - CVE-2025-20320 published to NVD
2025-07-21 - Last updated in NVD database

Technical Details for CVE-2025-20320

Vulnerability Analysis

The vulnerability resides in the handling of user-supplied input on the User Interface - Views configuration page. Splunk fails to properly canonicalize and validate path components submitted by authenticated users. A low-privileged account can supply path traversal sequences that escape the intended directory boundary. When an administrator processes the crafted request, the application performs a file deletion operation outside the expected scope. The resulting file removal disrupts core Splunk functionality, including indexing, search, and dashboard rendering. The flaw maps to [CWE-35] Path Traversal: .../...//, a common variant where multiple dot and slash sequences bypass shallow sanitization filters.

Root Cause

Splunk's view configuration handler does not enforce strict directory containment when resolving file paths supplied through the user interface. Input sanitization fails to neutralize relative path segments before passing the value to the underlying file system call. This allows references to files outside the directory the feature was designed to access.

Attack Vector

Exploitation follows a confused deputy pattern. A low-privileged Splunk user authenticates and crafts a malicious payload targeting the views endpoint. The attacker delivers a phishing link or rendered content to an administrator. When the administrator's browser issues the request, the server executes the file deletion under the administrator's session context. The attacker cannot trigger deletion at will and depends on victim interaction, which is reflected in the User Interaction Required attribute of the CVSS vector. Refer to the Splunk Security Advisory SVD-2025-0703 for vendor-confirmed details.

Detection Methods for CVE-2025-20320

Indicators of Compromise

Unexpected file deletions within $SPLUNK_HOME directories, particularly under etc/apps/ and view-related paths
HTTP requests to the views configuration endpoint containing ../, ..\, or URL-encoded traversal sequences such as %2e%2e%2f
Splunk service restarts, search head failures, or missing dashboard artifacts following user interface activity
Audit log entries showing low-privileged accounts submitting view configuration changes immediately before administrator session activity

Detection Strategies

Inspect Splunk _internal audit logs for views endpoint POST requests originating from non-admin, non-power role users
Correlate file deletion events on Splunk hosts with web request timestamps from administrator sessions
Alert on path traversal patterns in URL parameters and POST bodies destined for the Splunk management port (default 8089) or web port (default 8000)

Monitoring Recommendations

Enable file integrity monitoring on $SPLUNK_HOME/etc/ to detect unauthorized file removals
Forward Splunk web access logs and audit logs to a centralized analytics platform for cross-correlation
Track role changes and review accounts that retain access to the User Interface - Views capability

How to Mitigate CVE-2025-20320

Immediate Actions Required

Upgrade Splunk Enterprise to 9.4.3, 9.3.5, 9.2.7, 9.1.10, or later as applicable to your release branch
Confirm Splunk Cloud Platform tenants are running 9.3.2411.107, 9.3.2408.117, 9.2.2406.121, or later
Audit user role assignments and remove unnecessary access to the views configuration interface
Train administrators to avoid clicking untrusted links while authenticated to Splunk Web

Patch Information

Splunk addressed the vulnerability in the versions listed in advisory Splunk Security Advisory SVD-2025-0703. Splunk Cloud Platform customers receive the fix automatically during scheduled maintenance windows. On-premises operators must download and install fixed releases from the Splunk customer portal.

Workarounds

Restrict the edit_views capability to trusted administrative roles only
Place Splunk Web behind an authenticating reverse proxy with strict referer and origin validation to reduce phishing-driven request forgery
Segment administrator browsers from general-purpose web browsing to limit exposure to phishing payloads

bash

# Review users holding view-editing capabilities
$SPLUNK_HOME/bin/splunk list user -auth admin:<password>

# Verify installed Splunk version against fixed releases
$SPLUNK_HOME/bin/splunk version