CVE-2025-20322: Splunk Enterprise CSRF Vulnerability

CVE-2025-20322 Overview

CVE-2025-20322 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] affecting Splunk Enterprise and Splunk Cloud Platform. An unauthenticated attacker can craft a malicious Search Processing Language (SPL) search command that, when executed by a phished administrator, triggers a rolling restart in the Search Head Cluster (SHC). The result is a denial of service (DoS) against the search tier.

Exploitation requires social engineering. The attacker must trick an administrator-level user into initiating the request from their browser. The vulnerability affects Splunk Enterprise versions below 9.4.3, 9.3.5, 9.2.7, and 9.1.10, plus Splunk Cloud Platform versions below 9.3.2411.104, 9.3.2408.113, and 9.2.2406.119.

Critical Impact
A single crafted request executed by an authenticated administrator can force a rolling restart of the Search Head Cluster, disrupting search availability across the deployment.

Affected Products

Splunk Enterprise versions below 9.4.3, 9.3.5, 9.2.7, and 9.1.10
Splunk Cloud Platform versions below 9.3.2411.104, 9.3.2408.113, and 9.2.2406.119
Search Head Cluster deployments running vulnerable Splunk versions

Discovery Timeline

2025-07-07 - CVE-2025-20322 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-20322

Vulnerability Analysis

The flaw resides in how Splunk's web interface accepts SPL search commands capable of initiating cluster-wide administrative actions. Specifically, an SPL command that triggers a rolling restart of the Search Head Cluster can be delivered through a forged cross-origin request. Splunk does not adequately validate the origin or a per-request anti-CSRF token for this control path.

When an authenticated administrator visits an attacker-controlled page, the browser automatically attaches the administrator's Splunk session credentials to the outgoing request. The Splunk server processes the SPL command in the context of that privileged session and initiates the rolling restart procedure documented in the Splunk RestartSHC process.

Availability is the primary impact. Confidentiality and integrity are not affected. Search operations, scheduled reports, and dashboards depending on the SHC become unavailable during the restart window.

Root Cause

The root cause is missing or insufficient CSRF protection [CWE-352] on the endpoint that accepts SPL commands capable of invoking cluster management operations. The server trusts the session cookie without verifying that the request originated from a legitimate Splunk UI context.

Attack Vector

Exploitation requires user interaction from an administrator. The attacker hosts a page containing a forged HTTP request, such as a hidden form auto-submit or a fetch call to the Splunk instance. The victim, already authenticated to Splunk, visits the page. The browser sends the forged request with valid session cookies, and the SPL command executes with administrator privileges, triggering the rolling restart.

No verified proof-of-concept code is publicly available. Refer to the Splunk Security Advisory SVD-2025-0705 for vendor-provided technical detail.

Detection Methods for CVE-2025-20322

Indicators of Compromise

Unexpected rolling restart events in the Search Head Cluster captain logs (splunkd.log, metrics.log)
Inbound HTTP requests to Splunk Web containing SPL commands with Referer or Origin headers pointing to non-Splunk domains
Administrator sessions issuing cluster management SPL from unusual client IP addresses or user agents
Unscheduled rolling-restart entries in the deployment's audit trail

Detection Strategies

Monitor Splunk internal indexes (_internal, _audit) for restart initiation events correlated with administrator user context
Inspect web proxy and reverse proxy logs for cross-origin POST requests targeting Splunk Web administrative endpoints
Alert on browser sessions where administrators access Splunk Web immediately after visiting external, uncategorized domains

Monitoring Recommendations

Enable and centralize Splunk _audit logs to detect unauthorized administrative actions
Track SHC captain election and restart frequency as a baseline metric, with alerts on deviations
Review browser network telemetry from privileged admin workstations for suspicious cross-site requests

How to Mitigate CVE-2025-20322

Immediate Actions Required

Upgrade Splunk Enterprise to version 9.4.3, 9.3.5, 9.2.7, 9.1.10, or later
Confirm Splunk Cloud Platform instances are running 9.3.2411.104, 9.3.2408.113, 9.2.2406.119, or later
Require administrators to use dedicated browsers or isolated profiles when accessing Splunk Web
Enforce phishing-resistant multi-factor authentication for all administrator accounts

Patch Information

Splunk released fixed versions addressing CVE-2025-20322. Upgrade to Splunk Enterprise 9.4.3, 9.3.5, 9.2.7, or 9.1.10. Splunk Cloud Platform customers should verify their instance is running 9.3.2411.104, 9.3.2408.113, or 9.2.2406.119 or later. Full remediation details are provided in Splunk Security Advisory SVD-2025-0705.

Workarounds

Restrict access to Splunk Web administrative interfaces to trusted networks using firewall rules or a reverse proxy allowlist
Enforce short session timeouts for administrator accounts to shrink the CSRF exploitation window
Train administrators to log out of Splunk Web when not actively using the console
Deploy browser-level protections such as SameSite=Strict cookie enforcement on the Splunk Web front end where supported

bash

# Verify installed Splunk version against fixed releases
$SPLUNK_HOME/bin/splunk version

# Example nginx reverse proxy allowlist restricting Splunk Web admin access
# location /en-US/manager/ {
#     allow 10.0.0.0/8;
#     deny all;
#     proxy_pass https://splunk-backend:8000;
# }