The vulnerability exists due to a symlink following issue in Salt-SSH pre-flight option. A local user can create a specially crafted symbolic link to an empty file on the system, wait for the salt to create the file for further execution, update the symbolic link and point it to another file that is under attacker's control and execute the file with root privileges.

The remote SUSE Linux SLES15 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2023:4749-1 advisory.

  - allows an attacker to force Salt-SSH to run their script [fedora-all] (CVE-2023-34049)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the instance of SaltStack hosted on the remote server is affected by a security bypass vulnerability. The Salt-SSH pre-flight option copies the script to the target at a predictable path, which allows an attacker to force Salt-SSH to run their script. If an attacker has access to the target VM and knows the path to the pre-flight script before it runs they can ensure Salt-SSH runs their script with the privileges of the user running Salt-SSH.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:4386-1 advisory.

  - allows an attacker to force Salt-SSH to run their script [fedora-all] (CVE-2023-34049)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:4388-1 advisory.

  - allows an attacker to force Salt-SSH to run their script [fedora-all] (CVE-2023-34049)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:4389-1 advisory.

  - allows an attacker to force Salt-SSH to run their script [fedora-all] (CVE-2023-34049)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2023:4412-1 advisory.

  - allows an attacker to force Salt-SSH to run their script [fedora-all] (CVE-2023-34049)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:4387-1 advisory.

  - allows an attacker to force Salt-SSH to run their script [fedora-all] (CVE-2023-34049)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:4390-1 advisory.

  - allows an attacker to force Salt-SSH to run their script [fedora-all] (CVE-2023-34049)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-3eda7b85f5 advisory.

  - allows an attacker to force Salt-SSH to run their script [fedora-all] (CVE-2023-34049)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-a6699df922 advisory.

  - allows an attacker to force Salt-SSH to run their script [fedora-all] (CVE-2023-34049)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 37 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-89e8f3efc5 advisory.

  - allows an attacker to force Salt-SSH to run their script [fedora-all] (CVE-2023-34049)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
186881	SUSE SLES15 Security Update : SUSE Manager Salt Bundle (SUSE-SU-2023:4749-1)	Nessus	SuSE Local Security Checks	high
185733	SaltStack 3000 < 3005.4 / 3006 < 3006.4 Security Bypass	Nessus	Misc.	high
185450	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : salt (SUSE-SU-2023:4386-1)	Nessus	SuSE Local Security Checks	high
185449	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : salt (SUSE-SU-2023:4388-1)	Nessus	SuSE Local Security Checks	high
185448	SUSE SLES15 Security Update : salt (SUSE-SU-2023:4389-1)	Nessus	SuSE Local Security Checks	high
185447	SUSE SLES15 Security Update : SUSE Manager Server 4.3 (SUSE-SU-2023:4412-1)	Nessus	SuSE Local Security Checks	high
185446	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : salt (SUSE-SU-2023:4387-1)	Nessus	SuSE Local Security Checks	high
185445	SUSE SLES15 Security Update : salt (SUSE-SU-2023:4390-1)	Nessus	SuSE Local Security Checks	high
185374	Fedora 39 : salt (2023-3eda7b85f5)	Nessus	Fedora Local Security Checks	critical
185365	Fedora 38 : salt (2023-a6699df922)	Nessus	Fedora Local Security Checks	critical
185348	Fedora 37 : salt (2023-89e8f3efc5)	Nessus	Fedora Local Security Checks	critical

Detections

Analytics

CVE-2023-34049

high

Tenable Plugins

high

high

high

high

high

high

high

high

critical

critical

critical