Listen to this Post
How the CVE Works
CVE-2025-20319 affects Splunk Enterprise versions below 9.4.3, 9.3.5, 9.2.7, and 9.1.10. A user with a role possessing the `edit_scripted` and `list_inputs` capabilities can exploit improper input sanitization in scripted input files to execute arbitrary commands remotely. This occurs when malicious scripts are uploaded or modified, allowing privilege escalation or system compromise. The vulnerability stems from insufficient validation of user-supplied input in scripted input configurations, enabling attackers to inject and execute OS-level commands with the privileges of the Splunk service.
DailyCVE Form
Platform: Splunk Enterprise
Version: <9.4.3, 9.3.5, 9.2.7, 9.1.10
Vulnerability: Remote Code Execution
Severity: Critical
Date: 07/07/2025
Prediction: Patch by 08/15/2025
What Undercode Say
curl -X POST -H "Authorization: Bearer <token>" -d '{"script": "malicious_code"}' https://<splunk-server>/servicesNS/admin/search/data/inputs/scripted
import requests
payload = {"name": "exploit.sh", "script": "rm -rf /"}
requests.post("https://<splunk-server>/servicesNS/admin/search/data/inputs/scripted", headers={"Authorization": "Bearer <token>"}, json=payload)
How Exploit
- Attacker gains `edit_scripted` & `list_inputs` roles.
- Uploads/modifies scripted input with OS commands.
- Commands execute with Splunk service privileges.
Protection from this CVE
- Upgrade to patched versions.
- Restrict `edit_scripted` capability.
- Audit scripted inputs regularly.
Impact
- Full system compromise.
- Data exfiltration.
- Privilege escalation.
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
