PT-2017-16377 · Saltstack+1 · Saltstack Salt+1

Published 2017-04-02 · Updated 2022-05-17 · CVE-2017-5192

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SaltStack Salt versions prior to 2015.8.13 SaltStack Salt versions 2016.3.x prior to 2016.3.5 SaltStack Salt versions 2016.11.x prior to 2016.11.2

Description The issue arises when using the local batch client from salt-api in SaltStack Salt, where external authentication is not respected, allowing all authentication to be bypassed. This enables code execution for already-authenticated users, but only when running salt-api as the root user. The LocalClient.cmd batch() method client does not accept external auth credentials.

Recommendations For SaltStack Salt versions prior to 2015.8.13, update to version 2015.8.13 or later. For SaltStack Salt versions 2016.3.x prior to 2016.3.5, update to version 2016.3.5 or later. For SaltStack Salt versions 2016.11.x prior to 2016.11.2, update to version 2016.11.2 or later. As a temporary workaround, consider removing access to the LocalClient.cmd batch() method client from salt-api to prevent code execution for already-authenticated users.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

ALT-PU-2017-1403

CVE-2017-5192

GHSA-F2H7-4F84-8QRM

PYSEC-2017-38

Affected Products

Alt Linux

Saltstack Salt

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2017-5192 · Security Note
• https://docs.saltstack.com/en/2016.3/topics/releases/2015.8.13.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-5192 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-5192 · Security Note
• https://ubuntu.com/security/CVE-2017-5192 · Vendor Advisory
• https://docs.saltstack.com/en/2016.3/topics/releases/2016.3.5.html · Vendor Advisory
• https://docs.saltstack.com/en/latest/topics/releases/2016.11.2.html · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-5192 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-f2h7-4f84-8qrm · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2017-38 · Vendor Advisory
• https://github.com/saltstack/salt · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/salt/PYSEC-2017-38.yaml · Note