VMware is going to fix recent Salt issues in vROps
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2020-11651 +1 in the same advisory: …11652 | Authentication Bypass and Unauthenticated RCE in SaltStack Salt CVE-2020-11651 is a critical (CVSS 9.8) authentication bypass in SaltStack Salt's salt-master process: the ClearFuncs class fails to validate method calls, so a remote attacker can invoke privileged methods without authenticating. By sending crafted messages to the salt-master's network interface, an unauthenticated user can retrieve the master's root tokens/eauth credentials and use them to execute arbitrary commands on salt minions, yielding full remote code execution across the entire Salt deployment. Anyone running affected Salt versions before 2019.2.4 or 3000.x before 3000.2 — including Salt shipped in Debian, Ubuntu, openSUSE Leap, and VMware's Application Remote Collector — is exposed, especially masters reachable on their ZeroMQ ports. Exploitation is confirmed in the wild: the flaw is on CISA's KEV catalog, EPSS puts exploitation probability at 96.6%, attackers have been mass-scanning for vulnerable Salt installs, and breaches using this bug hit Cisco (six servers), LineageOS, Ghost, and DigiCert. Do: Upgrade salt-master to Salt 2019.2.4 or 3000.2 (or later), or apply the patched packages issued by Debian, Ubuntu, and openSUSE; VMware vROps customers should apply VMware's Application Remote Collector fix. Restrict access to the salt-master ZeroMQ ports (4505/4506) to trusted networks and review masters for signs of compromise, such as unexpected root tokens or unauthorized jobs run on minions. | 9.8 group max | 97% | KEV PoC ×2 |
| largetens of thousands of deployments (thousands of internet-exposed Salt masters, plus Salt bundled in Ubuntu/Debian/openSUSE and VMware ARC) |
Full article339 words · extracted from securityaffairs.com · click to collapse
VMware is going to address vulnerabilities impacting the vRealize Operations Manager (vROps) product, including two recently disclosed Salt issues.
Recently, researchers from F-Secure disclosed a number of vulnerabilities in the “Salt” framework, including two issues that have been exploited by attackers to take over Salt installations.
The two flaws, tracked as CVE-2020-11651 and CVE-2020-11652, are a directory traversal issue and an authentication bypass vulnerability respectively. Chaining the issue, an attacker could bypass authentication and run arbitrary code on Salt master servers exposed online.
Administrators of Salt servers reported attacks exploiting the above vulnerabilities last week, threat actors used them to deliver backdoors and miners.
Several organizations disclosed data breaches that involved exploitation of the above flaws, including LineageOS, Ghost, and DigiCert.
According to VMware, the Application Remote Collector (ARC) feature implemented in vROps 7.5 uses the Salt framework. The company rated as critical severity the authentication bypass flaw and as important severity the directory traversal issue.
“The Application Remote Collector (ARC) introduced with vRealize Operations Manager 7.5 utilizes Salt which is affected by CVE-2020-11651 and CVE-2020-11652. VMware has evaluated CVE-2020-11651 (Authentication Bypass) to be in the Critical severity range with a maximum CVSSv3 base score of 10.0 and CVE-2020-11652 (Directory Traversal) to be in the Important severity range with a maximum CVSSv3 base score of 7.5.” reads the advisory published by VMWare.
“CVE-2020-11651 (Authentication Bypass) may allow a malicious actor with network access to port 4505 or 4506 on the ARC to take control of the ARC and any Virtual Machines the ARC may have deployed a Telegraf agent to. CVE-2020-11652 (Directory Traversal) may allow a malicious actor with network access to port 4505 or 4506 on the ARC to access the entirety of the ARC filesystem,”
vROps 8.1.0, 8.0.x and 7.5.0 versions are affected by the vulnerabilities, VMware announced that it plans to release security patches are soon as possible. The virtualization giant has provided workarounds to mitigate the issues.
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – Facebook, hacking)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/103063/security/vmware-salt-issues-vrops.html