SaltStack 3000.x < 3001.8 / 3002.x < 3002.7 / 3003.x < 3003.3 Privilege Escalation

high Nessus Plugin ID 154852

Language:

Synopsis

The version of SaltStack running on the remote server is affected a Privilege Escalation vulnerability.

Description

According to its self-reported version number, the instance of SaltStack hosted on the remote server is affected by a command injection vulnerability that may result in privilege escalation. This vulnerability exists in the snapper module and allows for the possibility of local privilege escalation on a minion. The attack requires that a file is created with a pathname that is backed up by snapper, and that the master calls the snapper.diff function (which executes popen unsafely).

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version

Solution

Upgrade to SaltStack version referenced in the vendor security advisory.

Plugin Details

Severity: High

ID: 154852

File Name: saltstack_3003_3.nasl

Version: 1.7

Type: local

Agent: unix

Family: Misc.

Published: 11/3/2021

Updated: 11/27/2023

Supported Sensors: Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: Medium

Base Score: 4.6

Temporal Score: 3.6

Vector: CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2021-31607

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 7

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:saltstack:salt

Required KB Items: installed_sw/SaltStack Salt Master

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 9/2/2021

Vulnerability Publication Date: 9/2/2021

Reference Information

CVE: CVE-2021-31607

IAVA: 2021-A-0524-S

Detections

Analytics