Stored Cross-Site scripting (XSS) through Anchor Tag "href" in Navigation Bar Collections in Splunk Enterprise

This XSS vulnerability allows a malicious user with the adminallobjects role to inject arbitrary JavaScript code into the Splunk Enterprise interface. This code will then execute in the context of other users' browsers when they navigate to the affected collection. An attacker could leverage this to steal session cookies, redirect users to phishing sites, or deface the Splunk interface. The impact is particularly concerning given the high privileges associated with the adminallobjects role, potentially granting an attacker access to sensitive data and control over the Splunk environment. Successful exploitation could lead to unauthorized data access and modification, impacting the integrity and confidentiality of Splunk data.

Organizations heavily relying on Splunk Enterprise for security monitoring and incident response are particularly at risk. Environments where the adminallobjects role is broadly assigned, or where users have excessive privileges within Splunk, face a higher probability of exploitation. Shared hosting environments running Splunk Enterprise are also vulnerable.

• linux / server: Examine Splunk logs for unusual JavaScript execution attempts or suspicious network requests originating from the Splunk server. Use journalctl -u splunkd to filter for errors related to collection navigation.

journalctl -u splunkd | grep -i "javascript:"

• generic web: Monitor Splunk's web interface for unexpected behavior or redirects. Use curl to check for unusual characters in collection names and descriptions.

curl -I "http://splunk_server/app/your_app/collection/collection_name_with_potential_xss" | grep "Content-Type"

• windows / supply-chain: Review scheduled tasks and PowerShell scripts that interact with Splunk to ensure they are not compromised and injecting malicious code. Use Get-ScheduledTask to check for suspicious tasks.

Get-ScheduledTask | Where-Object {$_.TaskName -like "*splunk*"}

1. 2025-12-03Disclosure

   disclosure

2. 2025-12-03Patch

   patch

1. Gereserveerd2024-10-10
2. Gepubliceerd2025-12-03
3. EPSS bijgewerkt2026-03-23

The primary mitigation for CVE-2025-20385 is to upgrade Splunk Enterprise to version 10.1.2507.6 or later, or Splunk Cloud Platform to version 10.1.2507.6, 10.0.2503.7, or 9.3.2411.117. If immediate upgrade is not possible, consider restricting the adminallobjects role to only trusted users. While a direct WAF rule is difficult to implement due to the nature of XSS, carefully review and restrict allowed HTML tags and attributes within collection names and descriptions. After upgrade, confirm the vulnerability is resolved by attempting to inject a simple JavaScript payload within a collection's navigation bar and verifying that it does not execute.