CVE-2025-20378: Splunk Enterprise CSRF Vulnerability

CVE-2025-20378 Overview

CVE-2025-20378 is an open redirect vulnerability affecting Splunk Enterprise and Splunk Cloud Platform. The flaw resides in the return_to parameter of the Splunk Web login endpoint. An unauthenticated attacker can craft a malicious URL that redirects an authenticated user to an external site controlled by the attacker. Successful exploitation requires social engineering, since the victim must click the crafted link from their browser. The issue is tracked under CWE-601 (URL Redirection to Untrusted Site).

Critical Impact
Attackers can leverage the trusted Splunk domain to redirect authenticated users to phishing or malware distribution sites, undermining user trust and enabling credential theft campaigns.

Affected Products

Splunk Enterprise versions below 10.0.1, 9.4.5, 9.3.7, and 9.2.9
Splunk Cloud Platform versions below 10.0.2503.5, 9.3.2411.111, and 9.3.2408.121
Splunk Web login endpoint using the return_to parameter

Discovery Timeline

2025-11-12 - CVE-2025-20378 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-20378

Vulnerability Analysis

The vulnerability is a classic unvalidated redirect flaw in the Splunk Web login flow. The login endpoint accepts a return_to query parameter to determine where users are sent after authentication. Splunk failed to validate that this parameter references an internal, trusted destination. An attacker constructs a URL pointing to the legitimate Splunk login page but supplies an external URL in return_to. When the victim authenticates or interacts with the link, the browser follows the redirect to the attacker-controlled site.

Exploitation depends on user interaction, which limits at-will exploitation but pairs well with phishing. The redirect abuses the trust users place in the Splunk domain, making credential harvesting pages or malware payloads appear more legitimate.

Root Cause

The root cause is insufficient input validation on the return_to parameter. The login handler treats the parameter as a trusted destination without enforcing an allowlist of internal paths or verifying that the target host matches the Splunk deployment. This omission enables arbitrary redirection to any URL scheme and host the attacker specifies.

Attack Vector

The attack is delivered over the network and requires the victim to click a crafted link. A typical exploit URL takes the form of the Splunk login endpoint with a return_to parameter containing an encoded external URL such as an attacker-hosted phishing page. When Splunk Web processes the login flow, it issues an HTTP redirect to the attacker-supplied location instead of an internal Splunk view. Because the initial hostname belongs to a legitimate Splunk deployment, email filters and users may not flag the link as suspicious. See the Splunk Security Advisory SVD-2025-1101 for vendor technical details.

Detection Methods for CVE-2025-20378

Indicators of Compromise

Splunk Web access logs containing requests to the login endpoint with a return_to parameter referencing external hostnames or absolute URLs
HTTP 302 responses from Splunk Web with Location headers pointing to non-Splunk domains
Inbound email or messaging traffic linking to the Splunk login URL with encoded return_to payloads

Detection Strategies

Parse Splunk Web access logs and alert when the return_to parameter value does not begin with a relative path or an approved internal host
Correlate user click-through events from email security gateways with subsequent authentications originating from unusual referrers
Monitor DNS and proxy logs for outbound resolution to newly registered domains referenced in return_to values

Monitoring Recommendations

Enable verbose logging on Splunk Web to capture query strings for the /account/login endpoint
Establish a baseline of legitimate return_to values and alert on deviations
Review user reports of unexpected redirects from Splunk portals as part of phishing triage

How to Mitigate CVE-2025-20378

Immediate Actions Required

Upgrade Splunk Enterprise to version 10.0.1, 9.4.5, 9.3.7, or 9.2.9 or later
Upgrade Splunk Cloud Platform to 10.0.2503.5, 9.3.2411.111, or 9.3.2408.121 or later
Notify users about the phishing risk and provide guidance on inspecting URLs before clicking
Review recent authentication and redirect logs for suspicious return_to values

Patch Information

Splunk released fixed versions addressing the unvalidated redirect. Administrators should apply the patched builds referenced in Splunk Security Advisory SVD-2025-1101. Splunk Cloud Platform customers on managed tiers receive updates from Splunk directly, but on-premises Splunk Enterprise operators must plan and execute the upgrade.

Workarounds

Restrict access to Splunk Web to trusted networks or VPN users to limit exposure to external phishing links
Deploy a reverse proxy or web application firewall rule that inspects the return_to parameter and blocks external URLs
Train users to authenticate to Splunk through bookmarks rather than emailed links

bash

# Example WAF rule pattern to block external return_to values
# Reject requests where return_to contains a scheme or double-slash
SecRule ARGS:return_to "@rx ^(https?:|//)" \
    "id:1002001,phase:1,deny,status:400,\
    msg:'Blocked external return_to redirect (CVE-2025-20378)'"