CVE-2025-20323: Splunk Enterprise Privilege Escalation Flaw

CVE-2025-20323 Overview

CVE-2025-20323 is a broken access control vulnerability [CWE-284] in Splunk Enterprise. Splunk assigned it in advisory SVD-2025-0706. The flaw affects Splunk Enterprise versions below 9.4.3, 9.3.5, 9.2.7, and 9.1.10. A low-privileged authenticated user who does not hold the admin or power Splunk role can disable the Bucket Copy Trigger scheduled search within the Splunk Archiver application. The root cause is missing access controls on saved searches shipped with the Archiver app. The impact is limited to integrity of the archiver scheduling workflow, not confidentiality or availability of the platform itself.

Critical Impact
An authenticated low-privileged user can turn off the Bucket Copy Trigger scheduled search, disrupting Splunk Archiver bucket copy operations and potentially interfering with long-term data archival.

Affected Products

Splunk Enterprise versions below 9.4.3 (9.4.x branch)
Splunk Enterprise versions below 9.3.5 (9.3.x branch)
Splunk Enterprise versions below 9.2.7 (9.2.x branch) and below 9.1.10 (9.1.x branch)

Discovery Timeline

2025-07-07 - CVE-2025-20323 published to NVD and disclosed in Splunk advisory SVD-2025-0706
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-20323

Vulnerability Analysis

The vulnerability resides in the Splunk Archiver application, which ships with a scheduled saved search named Bucket Copy Trigger. This search coordinates the copying of Splunk index buckets to archival storage. Splunk enforces role-based access control on saved searches through capability grants and per-object ACLs. In affected versions, the Archiver app's saved searches lack proper ACL enforcement, so any authenticated user with access to the app can modify their enabled state. The attack requires only network access and low privileges, and no user interaction. The impact is scoped to the integrity of a scheduled task rather than data exfiltration or code execution.

Root Cause

The Splunk Archiver app ships saved searches without restrictive ACLs on the write path. Splunk's saved-search permission model relies on default.meta or local.meta entries specifying access = read : [ * ], write : [ admin ]. In affected Archiver builds, the write permission was not restricted to privileged roles, allowing any authenticated user to toggle the disabled flag on the Bucket Copy Trigger schedule.

Attack Vector

An attacker authenticates to Splunkweb or the REST API with any low-privileged account. They then issue a POST request to the saved-searches endpoint for the Archiver app, setting disabled=1 on Bucket Copy Trigger. Because the check for the admin or power role is missing on the object, the request succeeds. Subsequent scheduled runs of the bucket copy do not fire, which can silently degrade archival integrity until an administrator notices the disabled job.

No verified public proof-of-concept is available. See the Splunk Security Advisory SVD-2025-0706 for vendor technical details.

Detection Methods for CVE-2025-20323

Indicators of Compromise

Audit log entries in _audit index showing action=edit_search or action=disable on savedsearch="Bucket Copy Trigger" performed by users without the admin or power role.
REST API calls to /servicesNS/-/splunk_archiver/saved/searches/Bucket%20Copy%20Trigger originating from low-privileged accounts.
Unexpected gaps in Splunk Archiver bucket copy activity or missing archived buckets in the destination store.

Detection Strategies

Hunt in the _audit index for saved-search modifications: index=_audit action=edit sourcetype=audittrail object="Bucket Copy Trigger" and correlate the user field against the roles roster.
Alert on any state change to Archiver scheduled searches, regardless of user, until patched versions are deployed.
Baseline the enabled/disabled state of Bucket Copy Trigger on each search head and flag deviations.

Monitoring Recommendations

Forward _audit and _internal logs to a centralized analytics tier and retain long enough to reconstruct configuration drift.
Monitor the health of Splunk Archiver bucket copy jobs and alarm on missed scheduled executions.
Review role assignments to confirm that only intended accounts hold admin or power, reducing the population exposed by app-level ACL gaps.

How to Mitigate CVE-2025-20323

Immediate Actions Required

Upgrade Splunk Enterprise to 9.4.3, 9.3.5, 9.2.7, 9.1.10, or later on all search heads that run the Splunk Archiver app.
Inventory accounts with access to the Archiver app and remove app access for users who do not require it.
Verify that the Bucket Copy Trigger saved search is currently enabled and re-enable it if it was disabled without authorization.

Patch Information

Splunk addressed the missing ACLs in Splunk Enterprise 9.4.3, 9.3.5, 9.2.7, and 9.1.10. Full remediation guidance is published in Splunk Security Advisory SVD-2025-0706.

Workarounds

Restrict access to the Splunk Archiver app to trusted roles by editing app-level permissions in Settings > Apps > Permissions.
Manually tighten the ACL on the Bucket Copy Trigger saved search by setting write permissions to admin only in local.meta.
If the Archiver feature is not in use, disable or uninstall the Splunk Archiver app on affected search heads.

bash

# Example local.meta hardening for the Bucket Copy Trigger saved search
# Path: $SPLUNK_HOME/etc/apps/splunk_archiver/metadata/local.meta
[savedsearches/Bucket%20Copy%20Trigger]
access = read : [ admin, power ], write : [ admin ]
owner = nobody
export = system