PT-2020-3606 · Saltstack+3 · Saltstack Salt+3
Published
2016-11-21
·
Updated
2025-04-03
·
CVE-2020-11651
CVSS v2.0
10
Critical
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
SaltStack Salt versions prior to 2019.2.4
SaltStack Salt versions 3000 prior to 3000.2
Description
An issue was discovered in the salt-master process ClearFuncs class, which does not properly validate method calls. This allows a remote user to access some methods without authentication, potentially retrieving user tokens from the salt master and/or running arbitrary commands on salt minions. The vulnerability may also allow an attacker to access confidential data, compromise its integrity, and cause a denial of service. It is estimated that thousands of servers, approximately 6000, deployed in data centers and cloud environments are potentially affected.
Recommendations
For SaltStack Salt versions prior to 2019.2.4, update to version 2019.2.4 or later.
For SaltStack Salt versions 3000 prior to 3000.2, update to version 3000.2 or later.
As a temporary workaround, consider restricting access to the ClearFuncs class until a patch is available.
Restrict access to sensitive methods that can be used to retrieve user tokens or run arbitrary commands on salt minions to minimize the risk of exploitation.
Exploit
Fix
Missing Authentication
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Saltstack Salt
Suse
Ubuntu