SaltStack · Salt
CVE-2020-11652
SaltStack Salt Path Traversal Vulnerability
What it is
An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class allows access to some methods that improperly sanitize paths. These methods allow arbitrary directory access to authenticated users.
CISA: SaltStack Salt contains a path traversal vulnerability in the salt-master process ClearFuncs which allows directory access to authenticated users. Salt users who follow fundamental internet security guidelines and best practices are not affected by this vulnerability.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: May 3, 2022
- Added to the CISA list
- November 3, 2021
- Published
- April 30, 2020
- Severity
- Medium 6.5 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 86% in the top 0.3% of all known vulnerabilities
- Weakness
- CWE-22
- More details
- NVD · CVE.org · CISA
All references (12)
- http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00047.html
- https://www.debian.org/security/2020/dsa-4676
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-salt-2vx545AG
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00070.html
- https://usn.ubuntu.com/4459-1/
- https://docs.saltstack.com/en/latest/topics/releases/2019.2.4.html
- https://github.com/saltstack/salt/blob/v3000.2_docs/doc/topics/releases/3000.2.rst
- http://packetstormsecurity.com/files/157560/Saltstack-3000.1-Remote-Code-Execution.html
- http://www.vmware.com/security/advisories/VMSA-2020-0009.html
- http://packetstormsecurity.com/files/157678/SaltStack-Salt-Master-Minion-Unauthenticated-Remote-Code-Executio…
- https://lists.debian.org/debian-lts-announce/2020/05/msg00027.html
- http://support.blackberry.com/kb/articleDetail?articleNumber=000063758
More exploited flaws from SaltStack
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Nov 3, 2021 | Authentication Bypass | Salt | Critical 9.8 | 97% |
| Nov 3, 2021 | Shell Injection | Salt | Critical 9.8 | 99.6% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.