CVE-2025-20385 Overview
CVE-2025-20385 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] affecting Splunk Enterprise and Splunk Cloud Platform. A user holding a role with the admin_all_objects capability can craft a malicious payload through the href attribute of an anchor tag within a collection in the navigation bar. When another user views the affected navigation, the payload executes unauthorized JavaScript in the victim's browser session. Splunk documented the issue in advisory SVD-2025-1204 and shipped fixes across multiple maintenance branches.
Critical Impact
A privileged authenticated user can inject JavaScript into the Splunk navigation bar, executing arbitrary script in the browsers of other Splunk users who load the affected navigation.
Affected Products
- Splunk Enterprise versions below 10.0.2, 9.4.6, 9.3.8, and 9.2.10
- Splunk Cloud Platform versions below 10.1.2507.6, 10.0.2503.7, and 9.3.2411.117
- Deployments where users are assigned roles carrying the admin_all_objects capability
Discovery Timeline
- 2025-12-03 - CVE-2025-20385 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-20385
Vulnerability Analysis
The vulnerability is a stored XSS flaw in the Splunk Web navigation bar. The application fails to sanitize or safely render the href attribute of anchor tags inside navigation collections. An authenticated attacker with the admin_all_objects capability can craft a payload, for example using a javascript: URI scheme or a DOM-breaking attribute, that is persisted with the navigation configuration.
When a victim loads a view containing the modified navigation, their browser parses the malicious href and executes attacker-controlled script under the origin of the Splunk Web instance. Because the injection lives in shared navigation state, it can affect any user who renders the affected pages. Exploitation requires user interaction, and the scope changes because the payload executes in the security context of the victim's authenticated Splunk session.
Root Cause
The root cause is improper neutralization of user-controlled input during web page generation [CWE-79]. Splunk Web accepted attacker-influenced URI values in navigation collection anchors without enforcing an allow list of safe schemes such as http, https, or mailto, and without encoding output for the HTML attribute context.
Attack Vector
Exploitation requires an authenticated account holding the high-privilege admin_all_objects capability. The attacker modifies a navigation collection to include an anchor with a malicious href value. Any Splunk Web user who subsequently interacts with the tampered navigation triggers execution of the attacker's JavaScript, potentially enabling session token theft, forced actions on behalf of the victim, or pivoting within the Splunk deployment.
No verified public proof-of-concept code is available for this issue. Refer to the Splunk Security Advisory SVD-2025-1204 for vendor guidance.
Detection Methods for CVE-2025-20385
Indicators of Compromise
- Navigation XML or collection definitions containing anchor href values with javascript:, data:, or vbscript: URI schemes.
- Unexpected edits to navigation objects performed by accounts with the admin_all_objects capability.
- Splunk Web audit log entries showing modifications to navigation menus outside of change-managed windows.
Detection Strategies
- Review Splunk _audit index events for action=edit on navigation-related objects and correlate against approved change tickets.
- Scan exported navigation configurations for anchor tags whose href attributes do not begin with an approved scheme.
- Alert on new or modified navigation collections created by administrative accounts, particularly service or shared accounts.
Monitoring Recommendations
- Enable and forward Splunk internal audit logs to a centralized analytics platform for retention and correlation.
- Monitor role assignments that grant the admin_all_objects capability and flag additions to that role set.
- Track browser-side errors and Content Security Policy violations reported by Splunk Web to surface script execution attempts.
How to Mitigate CVE-2025-20385
Immediate Actions Required
- Upgrade Splunk Enterprise to 10.0.2, 9.4.6, 9.3.8, or 9.2.10, whichever is applicable to your branch.
- Confirm Splunk Cloud Platform tenants are running 10.1.2507.6, 10.0.2503.7, or 9.3.2411.117 or later; Splunk manages Cloud updates.
- Audit which roles hold the admin_all_objects capability and revoke it from accounts that do not require it.
Patch Information
Splunk released fixed builds documented in Splunk Security Advisory SVD-2025-1204. Splunk Enterprise customers should upgrade to the fixed maintenance releases listed above. Splunk Cloud Platform deployments are patched by Splunk during standard maintenance windows.
Workarounds
- Restrict the admin_all_objects capability to a minimal set of trusted administrative accounts.
- Require multi-factor authentication for accounts that retain administrative capabilities in Splunk Web.
- Review and validate navigation collection contents after any administrative change, rejecting anchors with non-standard URI schemes.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.