CVE-2025-20384: Splunk Authentication Bypass Vulnerability

CVE-2025-20384 Overview

CVE-2025-20384 is a log injection vulnerability affecting Splunk Enterprise and Splunk Cloud Platform. An unauthenticated remote attacker can inject American National Standards Institute (ANSI) escape codes into Splunk log files through the /en-US/static/ web endpoint. The flaw stems from improper input validation on this endpoint, allowing specially crafted HTTP requests to poison log entries. Successful exploitation lets attackers forge, obfuscate, or corrupt log data, undermining log integrity and downstream detection pipelines. The vulnerability is tracked as CWE-117: Improper Output Neutralization for Logs.

Critical Impact
Unauthenticated attackers can manipulate Splunk log content over the network, degrading the trustworthiness of security telemetry used for incident response and threat hunting.

Affected Products

Splunk Enterprise versions below 10.0.1, 9.4.6, 9.3.8, and 9.2.10
Splunk Cloud Platform versions below 10.1.2507.4, 10.0.2503.6, and 9.3.2411.117.125
Deployments exposing the /en-US/static/ web endpoint

Discovery Timeline

2025-12-03 - CVE-2025-20384 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-20384

Vulnerability Analysis

The vulnerability resides in how Splunk handles request data logged from the /en-US/static/ web endpoint. Splunk writes request-related data into log files without neutralizing ANSI escape sequences. Attackers can embed control characters such as \\x1b[ sequences inside HTTP request components. These sequences are interpreted by terminal emulators when analysts view logs via cat, tail, less, or SSH sessions.

Attackers use this behavior to hide malicious log entries, rewrite preceding lines, or inject fake entries that mimic legitimate activity. When log data is forwarded to downstream systems, escape sequences can also break parsers that assume plain-text content. The result is reduced fidelity of the very telemetry security teams depend on to identify intrusions.

Root Cause

The root cause is missing output neutralization at the logging boundary [CWE-117]. Splunk accepts unvalidated attacker-controlled input in requests to the static asset endpoint and writes it into log files without stripping or escaping non-printable and control characters. Because the endpoint is reachable without authentication, any network-adjacent attacker can trigger the write path.

Attack Vector

Exploitation requires only network access to a vulnerable Splunk web listener. The attacker issues an HTTP request to /en-US/static/ containing ANSI escape sequences within request fields that Splunk logs. No credentials, user interaction, or elevated privileges are needed. The injected data lands in Splunk's own log files, where it can distort the presentation of adjacent log lines or seed forged records.

Refer to the Splunk Security Advisory SVD-2025-1203 for vendor-supplied details on the affected code paths.

Detection Methods for CVE-2025-20384

Indicators of Compromise

HTTP requests to /en-US/static/ containing non-printable byte sequences, particularly 0x1B (ESC) followed by [
Splunk internal log entries (for example splunkd_access.log, web_access.log) containing embedded ANSI control characters
Unusual gaps, overwrites, or duplicated content when viewing Splunk log files in a terminal

Detection Strategies

Scan Splunk log files for byte patterns matching \\x1b\[[0-9;]*[A-Za-z] and alert on any hits in production logs
Inspect web access logs for requests to /en-US/static/ with URL-encoded escape sequences such as %1B%5B
Correlate anomalous log formatting with the source IP of the originating HTTP request to identify probing activity

Monitoring Recommendations

Forward Splunk internal logs into a separate analysis pipeline that treats them as untrusted input
Baseline normal request patterns to /en-US/static/ and alert on high-entropy or oversized query strings
Review dashboards and saved searches that read from _internal indexes for signs of tampered records

How to Mitigate CVE-2025-20384

Immediate Actions Required

Upgrade Splunk Enterprise to 10.0.1, 9.4.6, 9.3.8, 9.2.10, or later fixed releases as listed in the vendor advisory
Confirm Splunk Cloud Platform instances are running 10.1.2507.4, 10.0.2503.6, 9.3.2411.117.125, or newer
Restrict network exposure of Splunk Web to trusted management networks pending patching

Patch Information

Splunk has released fixed versions addressing the improper validation at the /en-US/static/ endpoint. Administrators should follow the upgrade guidance in the Splunk Security Advisory SVD-2025-1203. Splunk Cloud Platform customers receive the fix through the vendor's managed update process.

Workarounds

Place Splunk Web behind a reverse proxy that strips control characters (0x00–0x1F except tab/newline) from request URIs and headers
Restrict access to /en-US/static/ through web application firewall rules that block requests containing escape sequences
Always view Splunk log files with tools that render control characters safely, such as cat -v or less -R with sanitization

bash

# Example WAF-style rule to block ANSI escape sequences in requests to /en-US/static/
# ModSecurity rule illustrating the concept
SecRule REQUEST_URI "@beginsWith /en-US/static/" \
    "phase:1,deny,status:400,id:1002025,\
     msg:'Blocked ANSI escape sequence in Splunk static endpoint',\
     chain"
    SecRule REQUEST_URI|ARGS|REQUEST_HEADERS "@rx (?:\\x1b\[|%1[bB]%5[bB])"