Shortly after the public disclosure of critical vulnerabilities in the Salt framework, exploitation attempts were observed, as two open source projects were breached using these flaws Update 05/04/20: The proof-of-concept section has been updated to reflect the availability of PoC scripts.

CVE-2020-11651, CVE-2020-11652: Critical Salt Framework Vulnerabilities Exploited in the Wild

An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class allows access to some methods that improperly sanitize paths. These methods allow arbitrary directory access to authenticated users.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6849-1 advisory.

    It was discovered that Salt incorrectly validated method calls and sanitized paths. A remote attacker     could possibly use this issue to access some methods without authentication. (CVE-2020-11651,     CVE-2020-11652)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:2106-1 advisory.

  - Directory Traversal vulnerability in salt-api in SaltStack Salt before 2017.7.8 and 2018.3.x before     2018.3.3 allows remote attackers to determine which files exist on the server. (CVE-2018-15750)

  - SaltStack Salt before 2017.7.8 and 2018.3.x before 2018.3.3 allow remote attackers to bypass     authentication and execute arbitrary commands via salt-api(netapi). (CVE-2018-15751)

  - An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process     ClearFuncs class does not properly validate method calls. This allows a remote user to access some methods     without authentication. These methods can be used to retrieve user tokens from the salt master and/or run     arbitrary commands on salt minions. (CVE-2020-11651)

  - An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process     ClearFuncs class allows access to some methods that improperly sanitize paths. These methods allow     arbitrary directory access to authenticated users. (CVE-2020-11652)

  - In SaltStack Salt through 3002, salt-netapi improperly validates eauth credentials and tokens. A user can     bypass authentication and invoke Salt SSH. (CVE-2020-25592)

  - A Incorrect Implementation of Authentication Algorithm vulnerability in of SUSE SUSE Linux Enterprise     Server 15 SP 3; openSUSE Tumbleweed allows local attackers to execute arbitrary code via salt without the     need to specify valid credentials. This issue affects: SUSE SUSE Linux Enterprise Server 15 SP 3 salt     versions prior to 3002.2-3. openSUSE Tumbleweed salt version 3002.2-2.1 and prior versions.
    (CVE-2021-25315)

  - In SaltStack Salt 2016.9 through 3002.6, a command injection vulnerability exists in the snapper module     that allows for local privilege escalation on a minion. The attack requires that a file is created with a     pathname that is backed up by snapper, and that the master calls the snapper.diff function (which executes     popen unsafely). (CVE-2021-31607)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:0899-1 advisory.

  - Directory Traversal vulnerability in salt-api in SaltStack Salt before 2017.7.8 and 2018.3.x before     2018.3.3 allows remote attackers to determine which files exist on the server. (CVE-2018-15750)

  - SaltStack Salt before 2017.7.8 and 2018.3.x before 2018.3.3 allow remote attackers to bypass     authentication and execute arbitrary commands via salt-api(netapi). (CVE-2018-15751)

  - An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process     ClearFuncs class does not properly validate method calls. This allows a remote user to access some methods     without authentication. These methods can be used to retrieve user tokens from the salt master and/or run     arbitrary commands on salt minions. (CVE-2020-11651)

  - An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process     ClearFuncs class allows access to some methods that improperly sanitize paths. These methods allow     arbitrary directory access to authenticated users. (CVE-2020-11652)

  - In SaltStack Salt through 3002, salt-netapi improperly validates eauth credentials and tokens. A user can     bypass authentication and invoke Salt SSH. (CVE-2020-25592)

  - A Incorrect Implementation of Authentication Algorithm vulnerability in of SUSE SUSE Linux Enterprise     Server 15 SP 3; openSUSE Tumbleweed allows local attackers to execute arbitrary code via salt without the     need to specify valid credentials. This issue affects: SUSE SUSE Linux Enterprise Server 15 SP 3 salt     versions prior to 3002.2-3. openSUSE Tumbleweed salt version 3002.2-2.1 and prior versions.
    (CVE-2021-25315)

  - In SaltStack Salt 2016.9 through 3002.6, a command injection vulnerability exists in the snapper module     that allows for local privilege escalation on a minion. The attack requires that a file is created with a     pathname that is backed up by snapper, and that the master calls the snapper.diff function (which executes     popen unsafely). (CVE-2021-31607)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4459-1 advisory.

    It was discovered that Salt allows remote attackers to determine which files exist on the server. An     attacker could use that to extract sensitive information. (CVE-2018-15750)

    It was discovered that Salt has a vulnerability that allows an user to bypass authentication. An attacker     could use that to extract sensitive information, execute abritrary code or crash the server.
    (CVE-2018-15751)

    It was discovered that Salt is vulnerable to command injection. This allows an unauthenticated attacker     with network access to the API endpoint to execute arbitrary code on the salt-api host. (CVE-2019-17361)

    It was discovered that Salt incorrectly validated method calls and sanitized paths. A remote attacker     could possibly use this issue to access some methods without authentication. (CVE-2020-11651,     CVE-2020-11652)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for salt contains the following fixes :

  - Fix for TypeError in Tornado importer (bsc#1174165)

  - Require python3-distro only for TW (bsc#1173072)

  - Update to Salt version 3000: See release notes:
    https://docs.saltstack.com/en/latest/topics/releases/300     0.html

  - Add docker.logout to docker execution module.
    (bsc#1165572)

  - Add option to enable/disable force refresh for zypper.

  - Add publish_batch to ClearFuncs exposed methods.

  - Adds test for zypper abbreviation fix.

  - Avoid segfault from 'salt-api' under certain conditions     of heavy load managing SSH minions. (bsc#1169604)

  - Avoid traceback on debug logging for swarm module.
    (bsc#1172075)

  - Batch mode now also correctly provides return value.
    (bsc#1168340)

  - Better import cache handline.

  - Do not make file.recurse state to fail when msgpack     0.5.4. (bsc#1167437)

  - Do not require vendored backports-abc. (bsc#1170288)

  - Fix errors from unit tests due NO_MOCK and     NO_MOCK_REASON deprecation.

  - Fix for low rpm_lowpkg unit test.

  - Fix for temp folder definition in loader unit test.

  - Fix for unless requisite when pip is not installed.

  - Fix integration test failure for     test_mod_del_repo_multiline_values.

  - Fix regression in service states with reload argument.

  - Fix tornado imports and missing _utils after rebasing     patches.

  - Fix status attribute issue in aptpkg test.

  - Improved storage pool or network handling.

  - loop: fix variable names for until_no_eval.

  - Make 'salt.ext.tornado.gen' to use     'salt.ext.backports_abc' on Python 2.

  - Make setup.py script not to require setuptools greater     than 9.1.

  - More robust remote port detection.

  - Prevent sporious 'salt-api' stuck processes when     managing SSH minions. because of logging deadlock.
    (bsc#1159284)

  - Python3.8 compatibility changes.

  - Removes unresolved merge conflict in yumpkg module.

  - Returns a the list of IPs filtered by the optional     network list.

  - Revert broken changes to slspath made on Salt 3000     (saltstack/salt#56341). (bsc#1170104)

  - Sanitize grains loaded from roster_grains.json cache     during 'state.pkg'.

  - Various virt backports from 3000.2.

  - zypperpkg: filter patterns that start with dot.
    (bsc#1171906)

This update was imported from the SUSE:SLE-15-SP1:Update update project.

This update for salt contains the following fixes :

Fix for TypeError in Tornado importer (bsc#1174165)

Require python3-distro only for TW (bsc#1173072)

Update to Salt version 3000: See release notes:
https://docs.saltstack.com/en/latest/topics/releases/3000.html

Add docker.logout to docker execution module. (bsc#1165572)

Add option to enable/disable force refresh for zypper.

Add publish_batch to ClearFuncs exposed methods.

Adds test for zypper abbreviation fix.

Avoid segfault from 'salt-api' under certain conditions of heavy load managing SSH minions. (bsc#1169604)

Avoid traceback on debug logging for swarm module. (bsc#1172075)

Batch mode now also correctly provides return value. (bsc#1168340)

Better import cache handline.

Do not make file.recurse state to fail when msgpack 0.5.4.
(bsc#1167437)

Do not require vendored backports-abc. (bsc#1170288)

Fix errors from unit tests due NO_MOCK and NO_MOCK_REASON deprecation.

Fix for low rpm_lowpkg unit test.

Fix for temp folder definition in loader unit test.

Fix for unless requisite when pip is not installed.

Fix integration test failure for test_mod_del_repo_multiline_values.

Fix regression in service states with reload argument.

Fix tornado imports and missing _utils after rebasing patches.

Fix status attribute issue in aptpkg test.

Improved storage pool or network handling.

loop: fix variable names for until_no_eval.

Make 'salt.ext.tornado.gen' to use 'salt.ext.backports_abc' on Python 2.

Make setup.py script not to require setuptools greater than 9.1.

More robust remote port detection.

Prevent sporious 'salt-api' stuck processes when managing SSH minions.
because of logging deadlock. (bsc#1159284)

Python3.8 compatibility changes.

Removes unresolved merge conflict in yumpkg module.

Returns a the list of IPs filtered by the optional network list.

Revert broken changes to slspath made on Salt 3000 (saltstack/salt#56341). (bsc#1170104)

Sanitize grains loaded from roster_grains.json cache during 'state.pkg'.

Various virt backports from 3000.2.

zypperpkg: filter patterns that start with dot. (bsc#1171906)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update fixes the following issues :

salt :

Fix for TypeError in Tornado importer (bsc#1174165)

Require python3-distro only for TW (bsc#1173072)

Various virt backports from 3000.2

Avoid traceback on debug logging for swarm module (bsc#1172075)

Add publish_batch to ClearFuncs exposed methods

Update to salt version 3000 See release notes:
https://docs.saltstack.com/en/latest/topics/releases/3000.html

Zypperpkg: filter patterns that start with dot (bsc#1171906)

Batch mode now also correctly provides return value (bsc#1168340)

Add docker.logout to docker execution module (bsc#1165572)

Testsuite fix

Add option to enable/disable force refresh for zypper

Python3.8 compatibility changes

Prevent sporious 'salt-api' stuck processes when managing SSH minions because of logging deadlock (bsc#1159284)

Avoid segfault from 'salt-api' under certain conditions of heavy load managing SSH minions (bsc#1169604)

Revert broken changes to slspath made on Salt 3000 (saltstack/salt#56341) (bsc#1170104)

Returns a the list of IPs filtered by the optional network list

Fix CVE-2020-11651 and CVE-2020-11652 (bsc#1170595)

Do not require vendored backports-abc (bsc#1170288)

Fix partition.mkpart to work without fstype (bsc#1169800)

Enable building and installation for Fedora

Disable python2 build on Tumbleweed We are removing the python2 interpreter from openSUSE (SLE16). As such disable salt building for python2 there.

More robust remote port detection

Sanitize grains loaded from roster_grains.json cache during 'state.pkg'

Do not make file.recurse state to fail when msgpack 0.5.4 (bsc#1167437)

Build: Buildequire pkgconfig(systemd) instead of systemd pkgconfig(systemd) is provided by systemd, so this is de-facto no change. But inside the Open Build Service (OBS), the same symbol is also provided by systemd-mini, which exists to shorten build-chains by only enabling what other packages need to successfully build

Add new custom SUSE capability for saltutil state module

Fixes status attribute issue in aptpkg test

Make setup.py script not to require setuptools greater than 9.1

Loop: fix variable names for until_no_eval

Drop conflictive module.run state patch (bsc#1167437)

Update patches after rebase with upstream v3000 tag (bsc#1167437)

Fix some requirements issues depending on Python3 versions

Removes obsolete patch

Fix for low rpm_lowpkg unit test

Add python-singledispatch as dependency for python2-salt

Virt._get_domain: don't raise an exception if there is no VM

Fix for temp folder definition in loader unit test

Adds test for zypper abbreviation fix

Improved storage pool or network handling

Better import cache handline

Make 'salt.ext.tornado.gen' to use 'salt.ext.backports_abc' on Python 2

Fix regression in service states with reload argument

Fix integration test failure for test_mod_del_repo_multiline_values

Fix for unless requisite when pip is not installed

Fix errors from unit tests due NO_MOCK and NO_MOCK_REASON deprecation

Fix tornado imports and missing _utils after rebasing patches

Removes unresolved merge conflict in yumpkg module

Use full option name instead of undocumented abbreviation for zypper

Requiring python3-distro only for openSUSE/SLE >= 15 and not for Python 2 builds

Avoid possible user escalation upgrading salt-master (bsc#1157465) (CVE-2019-18897)

Fix unit tests failures in test_batch_async tests

Batch Async: Handle exceptions, properly unregister and close instances after running async batching to avoid CPU starvation of the MWorkers (bsc#1162327)

RHEL/CentOS 8 uses platform-python instead of python3

Loader: invalidate the import cachefor extra modules

Zypperpkg: filter patterns that start with dot (bsc#1171906)

Batch mode now also correctly provides return value (bsc#1168340)

Add docker.logout to docker execution module (bsc#1165572)

Improvements for chroot module

Add option to enable/disable force refresh for zypper

Prevent sporious 'salt-api' stuck processes when managing SSH minions because of logging deadlock (bsc#1159284)

Avoid segfault from 'salt-api' under certain conditions of heavy load managing SSH minions (bsc#1169604)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities were discovered in package salt, a configuration management and infrastructure automation software.

CVE-2020-11651

The salt-master process ClearFuncs class does not properly validate method calls. This allows a remote user to access some methods without authentication. These methods can be used to retrieve user tokens from the salt master and/or run arbitrary commands on salt minions.

CVE-2020-11652

The salt-master process ClearFuncs class allows access to some methods that improperly sanitize paths. These methods allow arbitrary directory access to authenticated users.

For Debian 8 'Jessie', these problems have been fixed in version 2014.1.13+ds-3+deb8u1.

We recommend that you upgrade your salt packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the salt3 package has been released.

An update of the salt package has been released.

F-Secure reports : CVE-2020-11651 - Authentication bypass vulnerabilities The ClearFuncs class processes unauthenticated requests and unintentionally exposes the _send_pub() method, which can be used to queue messages directly on the master publish server. Such messages can be used to trigger minions to run arbitrary commands as root.

The ClearFuncs class also exposes the method _prep_auth_info(), which returns the 'root key' used to authenticate commands from the local root user on the master server. This 'root key' can then be used to remotely call administrative commands on the master server. This unintentional exposure provides a remote un-authenticated attacker with root-equivalent access to the salt master.

CVE-2020-11652 - Directory traversal vulnerabilities The wheel module contains commands used to read and write files under specific directory paths. The inputs to these functions are concatenated with the target directory and the resulting path is not canonicalized, leading to an escape of the intended path restriction.

The get_token() method of the salt.tokens.localfs class (which is exposed to unauthenticated requests by the ClearFuncs class) fails to sanitize the token input parameter which is then used as a filename, allowing insertion of '..' path elements and thus reading of files outside of the intended directory. The only restriction is that the file has to be deserializable by salt.payload.Serial.loads().

According to its self-reported version number, the instance of SaltStack hosted on the remote server is prior to 2019.2.4, 3000.x prior to 3000.2. It is, therefore, affected by multiple vulnerabilities:

  - An authentication bypass vulnerabilities exists in the ClearFuncs class due to improper validation of     method calls. An unauthenticated, remote attacker can exploit this by accessing exposed methods to trigger     minions to run arbitrary commands as root, or to retrieve the root key to authenticate commands from the     local root user on the master server. (CVE-2020-11651)

  - A directory traversal vulnerabilities exists in the ClearFuncs class due to improper path sanitization. An     authenticated, remote attacker can exploit this by accessing the exposed get_token() method which allows     the insertion of double periods in the filename parameter to read files outside of the intended directory.
    The only restriction is that the file has to be deserializable by salt.payload.Serial.loads().
    (CVE-2020-11652)

Several vulnerabilities were discovered in salt, a powerful remote execution manager, which could result in retrieve of user tokens from the salt master, execution of arbitrary commands on salt minions, arbitrary directory access to authenticated users or arbitrary code execution on salt-api hosts.

This update for salt fixes the following issues :

  - Fix CVE-2020-11651 and CVE-2020-11652 (bsc#1170595)

This update was imported from the SUSE:SLE-15-SP1:Update update project.

This update for salt fixes the following issues :

Fix CVE-2020-11651 and CVE-2020-11652 (bsc#1170595)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
201017	Ubuntu 14.04 LTS : Salt vulnerabilities (USN-6849-1)	Nessus	Ubuntu Local Security Checks	critical
164603	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-6.1)	Nessus	Misc.	high
164572	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-6.1.1)	Nessus	Misc.	critical
164564	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-6.0.2.5)	Nessus	Misc.	critical
151732	openSUSE 15 Security Update : salt (openSUSE-SU-2021:2106-1)	Nessus	SuSE Local Security Checks	critical
151062	openSUSE 15 Security Update : salt (openSUSE-SU-2021:0899-1)	Nessus	SuSE Local Security Checks	critical
139659	Ubuntu 16.04 LTS / 18.04 LTS : Salt vulnerabilities (USN-4459-1)	Nessus	Ubuntu Local Security Checks	critical
139012	openSUSE Security Update : salt (openSUSE-2020-1074)	Nessus	SuSE Local Security Checks	critical
138795	SUSE SLED15 / SLES15 Security Update : salt (SUSE-SU-2020:1974-1)	Nessus	SuSE Local Security Checks	critical
138794	SUSE SLES15 Security Update : Salt (SUSE-SU-2020:1973-1)	Nessus	SuSE Local Security Checks	critical
136979	Debian DLA-2223-1 : salt security update	Nessus	Debian Local Security Checks	critical
136699	Photon OS 3.0: Salt3 PHSA-2020-3.0-0091	Nessus	PhotonOS Local Security Checks	critical
136695	Photon OS 1.0: Salt3 PHSA-2020-1.0-0294	Nessus	PhotonOS Local Security Checks	critical
136694	Photon OS 1.0: Salt PHSA-2020-1.0-0294	Nessus	PhotonOS Local Security Checks	critical
136687	FreeBSD : salt -- multiple vulnerabilities in salt-master process (6bf55af9-973b-11ea-9f2c-38d547003487)	Nessus	FreeBSD Local Security Checks	critical
136402	SaltStack < 2019.2.4 / 3000.x < 3000.2 Multiple Vulnerabilities	Nessus	Misc.	critical
136372	Debian DSA-4676-1 : salt - security update	Nessus	Debian Local Security Checks	critical
136306	openSUSE Security Update : salt (openSUSE-2020-564)	Nessus	SuSE Local Security Checks	critical
136170	SUSE SLES15 Security Update : salt (SUSE-SU-2020:1151-1)	Nessus	SuSE Local Security Checks	critical
136169	SUSE SLED15 / SLES15 Security Update : salt (SUSE-SU-2020:1150-1)	Nessus	SuSE Local Security Checks	critical

Detections

Analytics

CVE-2020-11652

medium

Tenable Plugins

critical

high

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical