SaltStack · Salt
CVE-2020-16846
SaltStack Salt Shell Injection Vulnerability
Exploited in attacks
Critical 9.8 Attack chance: 99.6%
What it is
An issue was discovered in SaltStack Salt through 3002. Sending crafted web requests to the Salt API, with the SSH client enabled, can result in shell injection.
CISA: SaltStack Salt allows an unauthenticated user with network access to the Salt API to use shell injections to run code on the Salt API using the SSH client. This vulnerability affects any users running the Salt API.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: May 3, 2022
- Added to the CISA list
- November 3, 2021
- Published
- November 6, 2020
- Severity
- Critical 9.8 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 99.6% in the top 0.1% of all known vulnerabilities
- Weakness
- CWE-78
- More details
- NVD · CVE.org · CISA
All references (14)
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TPOGB2F6XUAI…
- http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00029.html
- https://security.gentoo.org/glsa/202011-13
- https://www.debian.org/security/2021/dsa-4837
- https://github.com/saltstack/salt/releases
- https://www.saltstack.com/blog/on-november-3-2020-saltstack-publicly-disclosed-three-new-cves/
- http://packetstormsecurity.com/files/160039/SaltStack-Salt-REST-API-Arbitrary-Command-Execution.html
- https://www.zerodayinitiative.com/advisories/ZDI-20-1381/
- https://www.zerodayinitiative.com/advisories/ZDI-20-1383/
- https://www.zerodayinitiative.com/advisories/ZDI-20-1380/
- https://www.zerodayinitiative.com/advisories/ZDI-20-1379/
- https://www.zerodayinitiative.com/advisories/ZDI-20-1382/
- https://lists.debian.org/debian-lts-announce/2020/12/msg00007.html
- https://lists.debian.org/debian-lts-announce/2022/01/msg00000.html
More exploited flaws from SaltStack
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Nov 3, 2021 | Authentication Bypass | Salt | Critical 9.8 | 97% |
| Nov 3, 2021 | Path Traversal | Salt | Medium 6.5 | 86% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.