PT-2021-6057 · Saltstack+2 · Saltstack Salt+2
Stealthcopter
·
Published
2021-04-02
·
Updated
2023-12-21
·
CVE-2021-31607
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
SaltStack Salt versions 2016.9 through 3002.6
Description
The issue is related to a command injection vulnerability in the snapper module of SaltStack Salt, which can be exploited to achieve local privilege escalation on a minion. This can happen when a specially crafted file is created with a pathname that is backed up by snapper, and the master calls the
snapper.diff function, which executes popen unsafely.Recommendations
For SaltStack Salt versions 2016.9 through 3002.6, consider disabling the
snapper.diff function until a patch is available to prevent exploitation.
Restrict access to the snapper module to minimize the risk of privilege escalation.
Avoid using the snapper module for backup operations until the issue is resolved.Exploit
Fix
LPE
OS Command Injection
Command Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Saltstack Salt
Suse