Vulnerabilities

Directory traversal vulnerability in recv_file method allows arbitrary files to be written to the master cache directory.

Git Providers can read from the wrong environment because they get the same cache directory base name in Salt masters prior to 3005.2 or 3006.2. Anything that uses Git Providers with different environments can get garbage data or the wrong data, which can lead to wrongful data disclosure, wrongful executions, data corruption and/or crash.

Buffer Overflow vulnerability in Saltstack v.3003 and before allows attacker to execute arbitrary code via the func variable in salt/salt/modules/status.py file. NOTE: this is disputed by third parties because an attacker cannot influence the eval input

An issue was discovered in SaltStack Salt in versions before 3002.9, 3003.5, 3004.2. PAM auth fails to reject locked accounts, which allows a previously authorized user whose account is locked still run Salt commands when their account is locked. This affects both local shell accounts with an active session and salt-api users that authenticate via PAM eauth.

An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. When configured as a Master-of-Masters, with a publisher_acl, if a user configured in the publisher_acl targets any minion connected to the Syndic, the Salt Master incorrectly interpreted no valid targets as valid, allowing configured users to target any of the minions connected to the syndic with their configured commands. This requires a syndic master combined with publisher_acl configured on the Master-of-Masters, allowing users specified in the publisher_acl to bypass permissions, publishing authorized commands to any configured minion.

An issue was discovered in SaltStack Salt before 3003.3. A user who has control of the source, and source_hash URLs can gain full file system access as root on a salt minion.

In SaltStack Salt 2016.9 through 3002.6, a command injection vulnerability exists in the snapper module that allows for local privilege escalation on a minion. The attack requires that a file is created with a pathname that is backed up by snapper, and that the master calls the snapper.diff function (which executes popen unsafely).

CWE - CWE-287: Improper Authentication vulnerability in SUSE Linux Enterprise Server 15 SP 3; openSUSE Tumbleweed allows local attackers to execute arbitrary code via salt without the need to specify valid credentials. This issue affects: SUSE Linux Enterprise Server 15 SP 3 salt versions prior to 3002.2-3. openSUSE Tumbleweed salt version 3002.2-2.1 and prior versions. This issue affects: SUSE Linux Enterprise Server 15 SP 3 salt versions prior to 3002.2-3. openSUSE Tumbleweed salt version 3002.2-2.1 and prior versions.

An issue was discovered in through SaltStack Salt before 3002.5. salt-api does not honor eauth credentials for the wheel_async client. Thus, an attacker can remotely run any wheel modules on the master.

CVE-2020-16846 is a shell/command injection flaw (CWE-78) in the SSH client of SaltStack Salt's REST API (salt-api), affecting Salt through version 3002. An attacker triggers it by sending crafted web requests to salt-api when the SSH client is enabled, causing injected commands to run on the Salt master with the privileges of the salt-api process. The CVSS vector (network vector, low complexity, no privileges or user interaction required) indicates remote, unauthenticated code execution, and the flaw was commonly chained with the related salt-api authentication bypass CVE-2020-25592 for full unauthenticated takeover. Anyone running a vulnerable Salt master with salt-api enabled is exposed, including Salt packages shipped by Debian, Fedora, and openSUSE Leap. Exploitation is confirmed in the wild: the flaw is in CISA KEV (added 2021-11-03), carries a 99.6% EPSS probability of exploitation, and a public PoC is available.

Do: Upgrade Salt to 3002.2, 3001.4, or 3000.6 (or later), or install updated Salt packages from Debian, Fedora, or openSUSE; note this flaw is typically exploited together with CVE-2020-25592, so patch both. Until patched, restrict network access to salt-api (default port 8000), require authentication, and disable the SSH client if it is not needed. Given the CISA KEV listing, treat any unpatched salt-api instance as potentially compromised and review it for signs of exploitation.

CVE-2020-11651 is a critical (CVSS 9.8) authentication bypass in SaltStack Salt's salt-master process: the ClearFuncs class fails to validate method calls, so a remote attacker can invoke privileged methods without authenticating. By sending crafted messages to the salt-master's network interface, an unauthenticated user can retrieve the master's root tokens/eauth credentials and use them to execute arbitrary commands on salt minions, yielding full remote code execution across the entire Salt deployment. Anyone running affected Salt versions before 2019.2.4 or 3000.x before 3000.2 — including Salt shipped in Debian, Ubuntu, openSUSE Leap, and VMware's Application Remote Collector — is exposed, especially masters reachable on their ZeroMQ ports. Exploitation is confirmed in the wild: the flaw is on CISA's KEV catalog, EPSS puts exploitation probability at 96.6%, attackers have been mass-scanning for vulnerable Salt installs, and breaches using this bug hit Cisco (six servers), LineageOS, Ghost, and DigiCert.

Do: Upgrade salt-master to Salt 2019.2.4 or 3000.2 (or later), or apply the patched packages issued by Debian, Ubuntu, and openSUSE; VMware vROps customers should apply VMware's Application Remote Collector fix. Restrict access to the salt-master ZeroMQ ports (4505/4506) to trusted networks and review masters for signs of compromise, such as unexpected root tokens or unauthorized jobs run on minions.

In SaltStack Salt through 2019.2.0, the salt-api NET API with the ssh client enabled is vulnerable to command injection. This allows an unauthenticated attacker with network access to the API endpoint to execute arbitrary code on the salt-api host.

SaltStack Salt 2018.3, 2019.2 is affected by: SQL Injection. The impact is: An attacker could escalate privileges on MySQL server deployed by cloud provider. It leads to RCE. The component is: The mysql.user_chpass function from the MySQL module for Salt. The attack vector is: specially crafted password string. The fixed version is: 2018.3.4.

SaltStack Salt before 2017.7.8 and 2018.3.x before 2018.3.3 allow remote attackers to bypass authentication and execute arbitrary commands via salt-api(netapi).

In SaltStack Salt before 2016.3.6, compromised salt-minions can impersonate the salt-master.

Directory traversal vulnerability in minion id validation in SaltStack Salt before 2016.3.8, 2016.11.x before 2016.11.8, and 2017.7.x before 2017.7.2 allows remote minions with incorrect credentials to authenticate to a master via a crafted minion ID. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-12791.

Salt-api in SaltStack Salt before 2015.8.13, 2016.3.x before 2016.3.5, and 2016.11.x before 2016.11.2 allows arbitrary command execution on a salt-master via Salt's ssh_client.

Directory traversal vulnerability in minion id validation in SaltStack Salt before 2016.11.7 and 2017.7.x before 2017.7.1 allows remote minions with incorrect credentials to authenticate to a master via a crafted minion ID.

The salt-ssh minion code in SaltStack Salt 2016.11 before 2016.11.4 copied over configuration from the Salt Master without adjusting permissions, which might leak credentials to local attackers on configured minions (clients).

Salt before 2015.8.11 allows deleted minions to read or write to minions with the same id, related to caching.

Salt before 2015.5.10 and 2015.8.x before 2015.8.8, when PAM external authentication is enabled, allows attackers to bypass the configured authentication service by passing an alternate service with a command sent to LocalClient.

Salt 2015.8.x before 2015.8.4 does not properly handle clear messages on the minion, which allows man-in-the-middle attackers to execute arbitrary code by inserting packets into the minion-master data stream.