Splunk Enterprise/Cloud Platform Logendpoint return_to redirect

Summaryinfo

A vulnerability classified as problematic has been found in Splunk Enterprise and Cloud Platform. This affects an unknown function of the component Logendpoint. The manipulation of the argument return_to leads to redirect. This vulnerability is traded as CVE-2025-20378. It is possible to initiate the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in Splunk Enterprise and Cloud Platform (version now known). This issue affects some unknown processing of the component Logendpoint. The manipulation of the argument return_to with an unknown input leads to a redirect vulnerability. Using CWE to declare the problem leads to CWE-601. A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks. Impacted is integrity. The summary by CVE is:

In Splunk Enterprise versions below 10.0.1, 9.4.5, 9.3.7, 9.2.9, and Splunk Cloud Platform versions below 10.0.2503.5, 9.3.2411.111, and 9.3.2408.121, an unauthenticated attacker could craft a malicious URL using the `return_to` parameter of the Splunk Web login endpoint. When an authenticated user visits the malicious URL, it could cause an unvalidated redirect to an external malicious site. To be successful, the attacker has to trick the victim into initiating a request from their browser. The unauthenticated attacker should not be able to exploit the vulnerability at will.

It is possible to read the advisory at advisory.splunk.com. The identification of this vulnerability is CVE-2025-20378 since 10/10/2024. The exploitation is known to be difficult. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. It demands that the victim is doing some kind of user interaction. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1204.001 according to MITRE ATT&CK.

The vulnerability scanner Nessus provides a plugin with the ID 275170 (Splunk Enterprise 9.2.0 < 9.2.9, 9.3.0 < 9.3.7, 9.4.0 < 9.4.5, 10.0.0 < 10.0.1 (SVD-2025-1101)), which helps to determine the existence of the flaw in a target environment.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (275170) and CERT Bund (WID-SEC-2025-2588). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Affected

• Splunk Splunk Enterprise

Productinfo

Type

• Log Management Software

Vendor

• Splunk

Name

• Cloud Platform
• Enterprise

License

• commercial

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion