CVE-2025-20384: 
Splunk Enterprise vulnerability analysis and mitigation

CVE-2025-20384 is an unauthenticated log injection vulnerability in Splunk Enterprise and Splunk Cloud Platform that allows attackers to inject ANSI escape codes into Splunk log files via improper input validation at the /en-US/static/ web endpoint. Disclosed on December 3, 2025, it affects Splunk Enterprise versions below 10.0.1, 9.4.6, 9.3.8, and 9.2.10, and Splunk Cloud Platform versions below 10.1.2507.4, 10.0.2503.6, and 9.3.2411.117.125. It carries a CVSS v3.1 base score of 5.3 (Medium) (Splunk Advisory, NVD).

The root cause is classified as CWE-117 (Improper Output Neutralization for Logs): the /en-US/static/ web endpoint fails to sanitize or neutralize ANSI escape sequences embedded in HTTP request data before writing them to log files. An unauthenticated, network-accessible attacker can craft HTTP requests containing ANSI escape codes that are then written verbatim into Splunk log files, enabling log poisoning, forging of log entries, or obfuscation of existing log data. No authentication, user interaction, or special privileges are required for exploitation. A public proof-of-concept is available on GitHub (Splunk Advisory, PoC GitHub).

Successful exploitation allows an attacker to manipulate the integrity of Splunk audit logs and operational log data without any authentication, potentially poisoning audit trails, forging false log entries, or hiding malicious activity from security analysts and detection systems. This directly undermines the reliability of Splunk as a SIEM and log management platform, which could allow attackers to evade detection during or after an intrusion. There is no direct confidentiality or availability impact; the primary risk is to log integrity and the effectiveness of security monitoring (Splunk Advisory, NVD).

A public proof-of-concept exploit is available on GitHub (published March 2, 2026), but there is no evidence of active in-the-wild exploitation as of the latest reporting (PoC GitHub). The EPSS score is approximately 0.074% (0.000740), indicating a low probability of exploitation in the near term. No threat actor attribution or CISA KEV catalog listing has been identified for this CVE. The vulnerability is detectable via Nessus plugin 277115 (Tenable).

1. Reconnaissance: Identify internet-facing or network-accessible Splunk Enterprise or Splunk Cloud Platform instances running vulnerable versions (Enterprise below 9.2.10, 9.3.8, 9.4.6, or 10.0.1; Cloud Platform below 9.3.2411.117.125, 10.0.2503.6, or 10.1.2507.4) using tools like Shodan or Censys.
2. Craft malicious HTTP request: Construct an HTTP request targeting the /en-US/static/ endpoint that includes ANSI escape code sequences (e.g., \x1b[...m terminal control sequences) embedded in request parameters or headers.
3. Send the request: Transmit the crafted request to the target Splunk instance without any authentication. No credentials or session tokens are required.
4. Log injection achieved: The ANSI escape codes are written into Splunk log files without sanitization, allowing the attacker to poison log entries, forge false records, or obfuscate existing log data — potentially hiding malicious activity from security analysts reviewing logs in terminals that render ANSI codes (Splunk Advisory, PoC GitHub).

• Network: Unusual or repeated HTTP requests to the /en-US/static/ endpoint containing non-printable characters, percent-encoded ANSI escape sequences (e.g., %1b%5b), or other terminal control characters in request parameters or headers.
• Logs: Splunk log files (e.g., splunkd.log, web_access.log) containing raw ANSI escape sequences such as \x1b[, \033[, or garbled/colored output when viewed in a terminal; unexpected formatting changes or missing log entries in Splunk log files.
• File System: Log files with unusual byte sequences or binary content inconsistent with normal Splunk log output.

Splunk has released patched versions addressing this vulnerability. For Splunk Enterprise, upgrade to version 10.0.1, 9.4.6, 9.3.8, or 9.2.10 or later. For Splunk Cloud Platform, upgrade to version 10.1.2507.4, 10.0.2503.6, or 9.3.2411.117.125 or later. As an interim measure, monitor and restrict access to the /en-US/static/ endpoint and inspect HTTP requests for ANSI escape sequences. Upgrading to a patched version is the recommended long-term solution (Splunk Advisory).

Heise (a German technology news outlet) covered the Splunk security patches in December 2025, noting the potential for unauthorized access via this and related vulnerabilities (Heise). No significant researcher commentary or notable social media discussion specific to CVE-2025-20384 has been identified beyond standard vulnerability database aggregation.