वितरित खोज साथियों के माध्यम से अंध सर्वर साइड रिक्वेस्ट फोर्जरी (SSRF) Splunk Enterprise में

This SSRF vulnerability allows a malicious actor with elevated privileges within a Splunk environment to perform internal network reconnaissance. Specifically, an attacker possessing the change_authentication role can add new search peers and, during this process, trigger requests to internal IP addresses and ports. This enables them to map the internal network topology, identify running services, and potentially discover sensitive information residing on internal systems. The blast radius is limited to the internal network accessible from the Splunk search head, but successful exploitation could lead to further compromise if internal systems are vulnerable. While direct data exfiltration isn't possible through this SSRF, it provides a crucial foothold for lateral movement and reconnaissance.

Organizations utilizing Splunk Enterprise or Cloud Platform with distributed search architectures are at risk. Specifically, environments where users have been granted the change_authentication role without proper justification or oversight are particularly vulnerable. Shared hosting environments or those with legacy configurations where role assignments are not regularly reviewed should prioritize remediation.

• linux / server:

journalctl -u splunkd | grep -i "search peer" && journalctl -u splunkd | grep -i "internal ip"

• generic web:

curl -I <splunk_search_head_url>/services/server/peer_status | grep -i "internal ip"

1. 2025-12-03Disclosure

   disclosure

1. आरक्षित2024-10-10
2. प्रकाशित2025-12-03
3. EPSS अद्यतन2026-03-23

The primary mitigation for CVE-2025-20388 is to upgrade Splunk Enterprise or Cloud Platform to a version containing the fix. Upgrade to version 10.1.2507.4 for Splunk Enterprise or the corresponding fixed versions for Cloud Platform (10.1.2507.4, 10.0.2503.7, and 9.3.2411.116). If immediate upgrade is not feasible, restrict the change_authentication capability to only trusted users and carefully review any new search peer configurations. Consider implementing network segmentation to limit the potential impact of internal network scanning. After upgrade, confirm the fix by attempting to add a new search peer and verifying that internal IP/port enumeration is prevented.