PT-2020-3607 · Saltstack+3 · Saltstack Salt+3

Published 2016-11-21 · Updated 2024-06-25 · CVE-2020-11652

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:A

Name of the Vulnerable Software and Affected Versions SaltStack Salt versions prior to 2019.2.4 SaltStack Salt versions 3000 prior to 3000.2

Description An issue was discovered in SaltStack Salt where the salt-master process ClearFuncs class allows access to some methods that improperly sanitize paths, enabling arbitrary directory access to authenticated users. This is related to a lack of input validation mechanism in the ClearFuncs component of the SaltStack configuration management and remote execution system. Exploitation of this issue may allow a remote attacker to access confidential data.

Recommendations For SaltStack Salt versions prior to 2019.2.4, update to version 2019.2.4 or later. For SaltStack Salt versions 3000 prior to 3000.2, update to version 3000.2 or later. As a temporary workaround, consider restricting access to the ClearFuncs class methods until a patch is available.

Exploit

Fix

RCE

Path traversal

Weakness Enumeration

CWE-20

CWE-22

Related Identifiers

ALT-PU-2016-2317

ALT-PU-2017-2801

ALT-PU-2018-2416

ALT-PU-2019-2322

ALT-PU-2019-2359

ALT-PU-2020-1935

ALT-PU-2020-1949

ALT-PU-2020-2668

ALT-PU-2020-2697

ALT-PU-2021-1590

ALT-PU-2021-1591

ALT-PU-2021-1982

ALT-PU-2021-2076

ALT-PU-2022-1683

ALT-PU-2022-3218

BDU:2020-03942

CVE-2020-11652

DLA-2223-1

DSA-4676-1

DSA-4676-2

GHSA-VP49-2G4R-M3X3

OPENSUSE-SU-2020:0564-1

OPENSUSE-SU-2020:1074-1

OPENSUSE-SU-2020_0564-1

OPENSUSE-SU-2020_1074-1

OPENSUSE-SU-2021:0899-1

OPENSUSE-SU-2021:2106-1

OPENSUSE-SU-2021_0899-1

OPENSUSE-SU-2021_2106-1

PYSEC-2020-103

SALTSTACKCVE2020_11652

SUSE-SU-2020:1147-1

SUSE-SU-2020:1150-1

SUSE-SU-2020:1151-1

SUSE-SU-2020:1392-1

SUSE-SU-2020:1715-1

SUSE-SU-2020:1718-1

SUSE-SU-2020:1971-1

SUSE-SU-2020:1973-1

SUSE-SU-2020:1974-1

SUSE-SU-2021:2105-1

SUSE-SU-2021:2106-1

USN-4459-1

USN-6849-1

Affected Products

Alt Linux

Saltstack Salt

Suse

Ubuntu

References · 106

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/saltstack_salt_root_key.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/misc/saltstack_salt_unauth_rce.rb · Exploit
• 🔥 https://github.com/Al1ex/CVE-2020-11652 · Exploit
• 🔥 https://github.com/limon768/CVE-2020-11652-POC · Exploit
• 🔥 https://exploit-db.com/exploits/48421 · Exploit
• 🔥 http://packetstormsecurity.com/files/157678/SaltStack-Salt-Master-Minion-Unauthenticated-Remote-Code-Execution.html · Exploit
• https://ubuntu.com/security/CVE-2019-17361 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2020:1392-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2020:1971-1 · Vendor Advisory
• https://usn.ubuntu.com/4459-1 · Vendor Advisory
• https://debian.org/security/2020/dsa-4676 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2020:1074-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2021:0899-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-11652 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2021:2105-1 · Vendor Advisory