CVE-2025-20387
📋 TL;DR
This vulnerability allows non-administrator users on Windows systems to access the Splunk Universal Forwarder installation directory and all its contents after new installation or upgrade. This affects Windows installations of Splunk Universal Forwarder versions below 10.0.2, 9.4.6, 9.3.8, and 9.2.10.
💻 Affected Systems
- Splunk Universal Forwarder
📦 What is this software?
Splunk by Splunk
Splunk by Splunk
Splunk by Splunk
Splunk by Splunk
⚠️ Risk & Real-World Impact
Worst Case
Non-admin users could read sensitive configuration files, modify forwarder settings, inject malicious code, or access credentials stored in the installation directory, potentially leading to data exfiltration or lateral movement.
Likely Case
Unauthorized users reading configuration files, discovering network targets, or accessing logs containing sensitive information.
If Mitigated
Limited impact if proper access controls and monitoring are in place to detect unauthorized directory access.
🎯 Exploit Status
Exploitation requires local non-admin user access to the Windows machine. No authentication bypass needed beyond having a local user account.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 10.0.2, 9.4.6, 9.3.8, or 9.2.10
Vendor Advisory: https://advisory.splunk.com/advisories/SVD-2025-1206
Restart Required: Yes
Instructions:
1. Download the patched version from Splunk's website. 2. Run the installer as administrator. 3. Follow upgrade prompts. 4. Restart the Universal Forwarder service.
🔧 Temporary Workarounds
Manual Directory Permission Correction
windowsManually set correct permissions on the Splunk Universal Forwarder installation directory to restrict access to administrators only.
icacls "C:\Program Files\SplunkUniversalForwarder" /inheritance:r /grant:r "Administrators:(OI)(CI)F" /grant:r "SYSTEM:(OI)(CI)F"
🧯 If You Can't Patch
- Implement strict access controls and monitoring on the Splunk Universal Forwarder directory
- Restrict local user access to affected Windows machines and implement least privilege principles
🔍 How to Verify
Check if Vulnerable:
Check if non-administrator users can access the Splunk Universal Forwarder installation directory (typically C:\Program Files\SplunkUniversalForwarder).Check Version:
Navigate to SplunkUniversalForwarder\bin directory and run: splunk versionVerify Fix Applied:
Verify that only Administrators and SYSTEM have full control permissions on the installation directory after patching.📡 Detection & Monitoring
Log Indicators:
- Windows Security event logs showing unauthorized access attempts to Splunk directories
- Splunk forwarder logs showing configuration changes from non-admin users
Network Indicators:
- Unusual outbound connections from Splunk forwarder to unexpected destinations
SIEM Query:
source="WinEventLog:Security" EventCode=4663 ObjectName="*SplunkUniversalForwarder*" SubjectUserName!="SYSTEM" SubjectUserName!="*Administrator*"