In SaltStack Salt through 2019.2.0, the salt-api NET API with the ssh client enabled is vulnerable to command injection. This allows an unauthenticated attacker with network access to the API endpoint to execute arbitrary code on the salt-api host.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4459-1 advisory.

    It was discovered that Salt allows remote attackers to determine which files exist on the server. An     attacker could use that to extract sensitive information. (CVE-2018-15750)

    It was discovered that Salt has a vulnerability that allows an user to bypass authentication. An attacker     could use that to extract sensitive information, execute abritrary code or crash the server.
    (CVE-2018-15751)

    It was discovered that Salt is vulnerable to command injection. This allows an unauthenticated attacker     with network access to the API endpoint to execute arbitrary code on the salt-api host. (CVE-2019-17361)

    It was discovered that Salt incorrectly validated method calls and sanitized paths. A remote attacker     could possibly use this issue to access some methods without authentication. (CVE-2020-11651,     CVE-2020-11652)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several vulnerabilities were discovered in salt, a powerful remote execution manager, which could result in retrieve of user tokens from the salt master, execution of arbitrary commands on salt minions, arbitrary directory access to authenticated users or arbitrary code execution on salt-api hosts.

This update for salt fixes the following issues :

  - Avoid possible user escalation upgrading salt-master     (bsc#1157465) (CVE-2019-18897)

  - Fix unit tests failures in test_batch_async tests

  - Batch Async: Handle exceptions, properly unregister and     close instances after running async batching to avoid     CPU starvation of the MWorkers (bsc#1162327)

  - RHEL/CentOS 8 uses platform-python instead of python3

  - New configuration option for selection of grains in the     minion start event.

  - Fix 'os_family' grain for Astra Linux Common Edition

  - Fix for salt-api NET API where unauthenticated attacker     could run arbitrary code (CVE-2019-17361) (bsc#1162504)

  - Adds disabled parameter to mod_repo in aptpkg module     Move token with atomic operation Bad API token files get     deleted (bsc#1160931)

  - Support for Btrfs and XFS in parted and mkfs added

  - Adds list_downloaded for apt Module to enable     pre-downloading support Adds virt.(pool|network)_get_xml     functions

  - Various libvirt updates :

  - Add virt.pool_capabilities function

  - virt.pool_running improvements

  - Add virt.pool_deleted state

  - virt.network_define allow adding IP configuration

  - virt: adding kernel boot parameters to libvirt xml

  - Fix to scheduler when data['run'] does not exist     (bsc#1159118)

  - Fix virt states to not fail on VMs already stopped

  - Fix applying of attributes for returner rawfile_json     (bsc#1158940)

  - xfs: do not fail if type is not present (bsc#1153611)

  - Fix errors when running virt.get_hypervisor function

  - Align virt.full_info fixes with upstream Salt

  - Fix for log checking in x509 test

  - Read repo info without using interpolation (bsc#1135656)

  - Limiting M2Crypto to >= SLE15

  - Replacing pycrypto with M2Crypto (bsc#1165425)

This update was imported from the SUSE:SLE-15-SP1:Update update project.

This update for salt fixes the following issues :

Avoid possible user escalation upgrading salt-master (bsc#1157465) (CVE-2019-18897)

Fix unit tests failures in test_batch_async tests

Batch Async: Handle exceptions, properly unregister and close instances after running async batching to avoid CPU starvation of the MWorkers (bsc#1162327)

RHEL/CentOS 8 uses platform-python instead of python3

New configuration option for selection of grains in the minion start event.

Fix 'os_family' grain for Astra Linux Common Edition

Fix for salt-api NET API where unauthenticated attacker could run arbitrary code (CVE-2019-17361) (bsc#1162504)

Adds disabled parameter to mod_repo in aptpkg module Move token with atomic operation Bad API token files get deleted (bsc#1160931)

Support for Btrfs and XFS in parted and mkfs added

Adds list_downloaded for apt Module to enable pre-downloading support Adds virt.(pool|network)_get_xml functions

Various libvirt updates :

  - Add virt.pool_capabilities function

  - virt.pool_running improvements

  - Add virt.pool_deleted state

  - virt.network_define allow adding IP configuration

virt: adding kernel boot parameters to libvirt xml

Fix to scheduler when data['run'] does not exist (bsc#1159118)

Fix virt states to not fail on VMs already stopped

Fix applying of attributes for returner rawfile_json (bsc#1158940)

xfs: do not fail if type is not present (bsc#1153611)

Fix errors when running virt.get_hypervisor function

Align virt.full_info fixes with upstream Salt

Fix for log checking in x509 test

Read repo info without using interpolation (bsc#1135656)

Limiting M2Crypto to >= SLE15

Replacing pycrypto with M2Crypto (bsc#1165425)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

SaltStack reports :

With the Salt NetAPI enabled in addition to having a SSH roster defined, unauthenticated access is possible when specifying the client as SSH.

Additionally, when the raw_shell option is specified any arbitrary command may be run on the Salt master when specifying SSH options.

ID	Name	Product	Family	Severity
139659	Ubuntu 16.04 LTS / 18.04 LTS : Salt vulnerabilities (USN-4459-1)	Nessus	Ubuntu Local Security Checks	critical
136372	Debian DSA-4676-1 : salt - security update	Nessus	Debian Local Security Checks	critical
134696	openSUSE Security Update : salt (openSUSE-2020-357)	Nessus	SuSE Local Security Checks	critical
134622	SUSE SLED15 / SLES15 Security Update : salt (SUSE-SU-2020:0684-1)	Nessus	SuSE Local Security Checks	critical
134336	FreeBSD : salt -- salt-api vulnerability (8c98e643-6008-11ea-af63-38d547003487)	Nessus	FreeBSD Local Security Checks	critical

Detections

Analytics

CVE-2019-17361

critical

Tenable Plugins

critical

critical

critical

critical

critical