CVE-2025-20367: Splunk Enterprise XSS Vulnerability

CVE-2025-20367 Overview

CVE-2025-20367 is a cross-site scripting (XSS) vulnerability in Splunk Enterprise and Splunk Cloud Platform. A low-privileged authenticated user without the admin or power role can craft a malicious payload through the dataset.command parameter of the /app/search/table endpoint. The payload executes unauthorized JavaScript in the browser of any user who loads the crafted request. The flaw is tracked under [CWE-79] (Improper Neutralization of Input During Web Page Generation).

Critical Impact
An authenticated low-privileged attacker can execute arbitrary JavaScript in a victim's browser session, potentially hijacking Splunk sessions, exfiltrating dashboard data, or pivoting to administrative actions when a privileged user is targeted.

Affected Products

Splunk Enterprise versions below 9.4.4, 9.3.6, and 9.2.8
Splunk Cloud Platform versions below 9.3.2411.109 and 9.3.2408.119
Splunk Cloud Platform versions below 9.2.2406.122

Discovery Timeline

2025-10-01 - CVE-2025-20367 published to NVD
2026-10-18 - Last updated in NVD database

Technical Details for CVE-2025-20367

Vulnerability Analysis

The vulnerability exists in the /app/search/table endpoint of Splunk Web. The endpoint accepts a dataset.command parameter that is reflected into the rendered page without sufficient output encoding. An authenticated user with only basic access rights can embed JavaScript inside this parameter. When a victim loads the crafted URL, the browser interprets the payload as part of the page and executes it in the context of the Splunk application. The scope is marked as changed in the CVSS vector, indicating that script execution impacts resources beyond the vulnerable component, such as the browser session of the targeted user.

Root Cause

The root cause is improper neutralization of user-controlled input in the dataset.command parameter. Splunk Web does not escape or sanitize the parameter value before including it in HTML output. Any string that forms a valid HTML or JavaScript construct is rendered as live code rather than inert text.

Attack Vector

Exploitation requires network access to the Splunk Web interface and a valid low-privilege account. The attacker constructs a URL targeting /app/search/table with a malicious dataset.command value and delivers it to a victim through phishing, chat, or a shared dashboard. User interaction is required: the victim must open the link while authenticated to Splunk. Successful exploitation yields JavaScript execution under the victim's Splunk origin, exposing session cookies, CSRF tokens, and the ability to issue arbitrary requests on the victim's behalf.

The vulnerability manifests when the dataset.command query parameter is rendered into the search table view. See the Splunk Security Advisory SVD-2025-1002 for vendor technical details.

Detection Methods for CVE-2025-20367

Indicators of Compromise

Requests to /app/search/table containing script tags, event handlers (such as onerror, onload), or javascript: URIs within the dataset.command parameter.
Unusual URL-encoded payloads in dataset.command values, including sequences such as %3Cscript%3E or %3Cimg.
Access logs showing low-privileged accounts generating /app/search/table requests immediately before privileged users access the same URL.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect query parameters on /app/search/table for HTML and JavaScript metacharacters.
Hunt in Splunk _internal web access logs for anomalous dataset.command parameter lengths or encoded script content.
Correlate referrer headers to identify users who clicked suspicious URLs that originated from internal messaging or email.

Monitoring Recommendations

Enable verbose logging on Splunk Web and forward access logs to a centralized analytics platform for retention and search.
Alert on repeated 200-status requests to /app/search/table with query strings exceeding typical baselines.
Monitor administrator account activity for unexpected search, dashboard, or configuration changes that follow a suspicious link click.

How to Mitigate CVE-2025-20367

Immediate Actions Required

Upgrade Splunk Enterprise to version 9.4.4, 9.3.6, 9.2.8, or later as applicable to your release train.
Verify Splunk Cloud Platform instances have been updated to 9.3.2411.109, 9.3.2408.119, or 9.2.2406.122 or later; Splunk manages Cloud upgrades directly.
Review and reduce the number of accounts that hold any Splunk role, enforcing least privilege for interactive users.

Patch Information

Splunk released fixed builds for both Splunk Enterprise and Splunk Cloud Platform. Refer to Splunk Security Advisory SVD-2025-1002 for the complete list of fixed versions and upgrade guidance. Splunk Cloud Platform customers receive the fix through the standard managed update process.

Workarounds

Restrict access to Splunk Web from untrusted networks using firewall rules or a reverse proxy allowlist until patches are applied.
Place Splunk Web behind a WAF configured to block script metacharacters in query parameters targeting /app/search/table.
Train users to avoid clicking Splunk URLs received from untrusted sources, since exploitation requires victim interaction.

bash

# Example WAF rule concept to block script payloads in dataset.command
# (ModSecurity-style pseudo-rule, adapt to your WAF syntax)
SecRule REQUEST_URI "@contains /app/search/table" \
  "chain,phase:2,deny,status:403,id:1002001,msg:'CVE-2025-20367 XSS attempt'"
  SecRule ARGS:dataset.command "@rx (?i)(<script|onerror=|onload=|javascript:)" "t:urlDecodeUni"