CVE-2025-20373: Client Secrets Exposed in Splunk Add-on for Palo Alto Networks

Overview

CVE-2025-20373 describes a low-severity vulnerability found in the Splunk Add-on for Palo Alto Networks versions prior to 2.0.2. This vulnerability involves the exposure of client secrets in plain text within the _internal index during the process of adding new “Data Security Accounts.” While the impact is limited by the requirement of local log access or administrative privileges, understanding and mitigating this risk is crucial for maintaining a secure Splunk environment.

Technical Details

The vulnerability arises from the way the Splunk Add-on for Palo Alto Networks handles the storage of client secrets during the creation of new Data Security Accounts. Instead of encrypting or securely storing these secrets, the add-on inadvertently logs them in plain text to the _internal index. This index is intended for internal Splunk logging and debugging purposes.

An attacker with local access to the log files on the Splunk server, or an attacker with administrative access to Splunk itself, could potentially retrieve these secrets from the _internal index. The exposed secrets could then be used to impersonate the Data Security Accounts and potentially gain unauthorized access to systems and data.

CVSS Analysis

The Common Vulnerability Scoring System (CVSS) assigns a score of 2.7 to CVE-2025-20373. This is classified as LOW severity. The CVSS vector string will generally look something like this (but may vary slightly depending on the calculator used): AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N. This reflects the following:

• Attack Vector (AV:L): Local access is required.
• Attack Complexity (AC:L): Low complexity to exploit.
• Privileges Required (PR:H): High privileges (administrative access) are typically needed.
• User Interaction (UI:N): No user interaction is required.
• Scope (S:U): Unchanged scope.
• Confidentiality (C:L): Limited impact on confidentiality.
• Integrity (I:N): No impact on integrity.
• Availability (A:N): No impact on availability.

While the score is low, the potential impact of exposed secrets should not be ignored.

Possible Impact

Exploitation of this vulnerability could allow an attacker to:

• Gain unauthorized access to systems and data protected by the Data Security Accounts.
• Impersonate valid users, potentially bypassing security controls.
• Conduct further attacks leveraging the compromised credentials.

The severity of the impact depends heavily on the permissions and access levels associated with the compromised Data Security Accounts.

Mitigation or Patch Steps

1. Upgrade the Splunk Add-on for Palo Alto Networks: The primary mitigation is to upgrade to version 2.0.2 or later, where this vulnerability has been addressed.
2. Review and Restrict Access to the _internal Index: Limit access to the _internal index to only those users and roles who absolutely require it. Specifically, ensure that only administrator-level roles have access.
3. Audit Existing Log Data: If feasible, audit existing data within the _internal index for any instances of exposed client secrets. If found, take immediate steps to revoke and regenerate the compromised credentials.
4. Follow Splunk’s Security Best Practices: Implement and adhere to Splunk’s security best practices for role management and access control.

References

• Splunk Advisory SVD-2025-1105
• Define roles on the Splunk platform with capabilities