CVE-2025-22621: Splunk App for SOAR Privilege Escalation

CVE-2025-22621 Overview

CVE-2025-22621 affects the Splunk App for SOAR in versions 1.0.67 and lower. The Splunk documentation for the app previously recommended adding the admin_all_objects capability to the splunk_app_soar role. This guidance could grant excessive permissions to low-privileged users who do not hold the admin Splunk role. The result is improper access control, allowing users to reach objects they should not manage. The issue is classified under CWE-269: Improper Privilege Management.

Critical Impact

Low-privileged Splunk users assigned the splunk_app_soar role could inherit administrative-equivalent object access, breaking least-privilege boundaries within the Splunk deployment.

Affected Products

• Splunk App for SOAR versions 1.0.67 and lower
• Splunk deployments where the splunk_app_soar role was configured per prior documentation guidance
• Environments with non-admin users assigned the splunk_app_soar role

Discovery Timeline

• 2025-01-07 - CVE-2025-22621 published to the National Vulnerability Database
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-22621

Vulnerability Analysis

The vulnerability originates in configuration guidance rather than a code defect. Splunk documentation instructed administrators to grant the admin_all_objects capability to the splunk_app_soar role. That capability provides broad access to Splunk objects regardless of ownership or sharing scope. When applied to a role assigned to non-administrative users, it elevates those users beyond their intended authorization boundary.

Exploitation requires an authenticated user with the splunk_app_soar role, user interaction, and higher attack complexity. A successful attack impacts confidentiality and integrity of Splunk objects but does not affect availability. The scope remains unchanged, meaning impact is limited to the vulnerable Splunk instance.

Root Cause

The root cause is a documentation-driven misconfiguration. The admin_all_objects capability grants blanket read and write access to all objects across the Splunk instance. Assigning this capability to any role held by non-admin users effectively bypasses role-based access control constraints that would otherwise segment user permissions.

Attack Vector

An attacker with a low-privileged Splunk account holding the splunk_app_soar role can access, view, or modify Splunk knowledge objects, saved searches, dashboards, and configurations that should be restricted to administrators. The attack requires network access to the Splunk instance and user interaction. No exploit code is publicly available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Refer to the Splunk Security Advisory SVD-2025-0101 for vendor technical details.

Detection Methods for CVE-2025-22621

Indicators of Compromise

• Presence of the admin_all_objects capability on the splunk_app_soar role in authorize.conf
• Non-admin user accounts assigned to the splunk_app_soar role
• Splunk audit log entries showing object modifications by users lacking the admin role

Detection Strategies

• Audit Splunk role definitions and enumerate all capabilities granted to splunk_app_soar
• Review Splunk _audit index for actions performed by splunk_app_soar role members against objects outside their expected scope
• Correlate user role assignments against expected privilege tiers to identify over-privileged accounts

Monitoring Recommendations

• Continuously monitor changes to authorize.conf and role capability assignments in Splunk
• Alert on new user assignments to the splunk_app_soar role
• Track object access patterns for users holding the splunk_app_soar role to identify anomalous activity

How to Mitigate CVE-2025-22621

Immediate Actions Required

• Remove the admin_all_objects capability from the splunk_app_soar role in all Splunk deployments
• Upgrade the Splunk App for SOAR to a version above 1.0.67 per vendor guidance
• Review all users currently assigned the splunk_app_soar role and confirm they require access
• Follow updated configuration guidance in the Splunk Security Advisory SVD-2025-0101

Patch Information

Splunk updated the app documentation and released a fixed version of the Splunk App for SOAR. Consult the Splunk Security Advisory SVD-2025-0101 for the specific fixed version and remediation steps.

Workarounds

• Manually edit the splunk_app_soar role to remove the admin_all_objects capability
• Assign only the minimum capabilities required for SOAR app functionality
• Restrict splunk_app_soar role membership to accounts that already require administrative privileges

# Configuration example: remove admin_all_objects from splunk_app_soar role
# Edit $SPLUNK_HOME/etc/apps/splunk_app_soar/local/authorize.conf
[role_splunk_app_soar]
# Remove or comment out the following line:
# admin_all_objects = enabled

# Reload authorization after making changes
splunk reload auth