CVE-2020-11652

CVE-2020-11652 is a path traversal flaw (CWE-22) in the salt-master process of SaltStack Salt: several methods in the ClearFuncs class improperly sanitize paths, allowing an authenticated user to obtain arbitrary directory access on the master. It is triggered by sending crafted requests to the affected ClearFuncs methods over the network; the CVSS score (6.5, C:H/I:N/A:N) reflects high confidentiality impact, i.e., unauthorized access to files and directories outside the intended scope. An attacker who can authenticate to a vulnerable salt-master gains arbitrary directory/file access, and the closely related ClearFuncs bugs in the same code were chained into unauthenticated remote code execution in the publicly available exploits. Affected are deployments running SaltStack Salt before 2019.2.4 or 3000 before 3000.2, including Salt shipped in Debian, Ubuntu and openSUSE Leap and embedded in products such as VMware vRealize Operations Application Remote Collector and BlackBerry Workspaces Server. Exploitation is confirmed in the wild: attackers mass-scanned the internet for vulnerable Salt installs and breached servers at Cisco (VIRL), Ghost, DigiCert and LineageOS, and the flaw is on the CISA KEV list.

What to do: Upgrade Salt to 2019.2.4 or 3000.2 or later, or apply the equivalent distribution/vendor updates from Debian, Canonical, SUSE, VMware and BlackBerry. Restrict network access to salt-master's 4505/4506 ports so only trusted systems can reach the ClearFuncs methods, and review masters for signs of compromise (unexpected file access or authentication via eauth/wheel) given confirmed in-the-wild exploitation.