cve-2020-11651

CVE-2020-11651 이것은 CVE-2020-11651에 대한 POC로, salt stack master 및/또는 모든 관련 minion에서 사전 인증 RCE를 획득합니다. 이슈에 대한 간단한 세부 정보는 여기에서 확인할 수 있습니다. 2020-11652에 대한 POC는 포함되지 않았습니다. 이는 salt.cmd의 runner를 cmd.execcode 함수로 생성하여 master에서 명령 실행을 획득합니다. 상호작용 기능은 구현되어 있지 않으므로, 리버스 셸을 받아야 합니다. 사용법 Debian10 인스턴스에서...

salt-vulnerabilities

Salt Stack Profile このプロファイルは、お使いの Salt インストールが CVE-2020-11651 および CVE-2020-11652 から保護されるパッチレベルであることを確認します。 具体的には、パッケージ salt-api、salt-cloud、salt-master、salt-minion、salt-ssh、salt-syndic、salt がバージョン 3000.2 以降、または 2019.2.4 以降であるか、存在しないことを確認します。 また、コマンドラインに "salt" コマンドが存在するかどうかを確認し、存在する場合は、salt...

SUSE CVE-2025-22237

An attacker with access to a minion key can exploit the 'on demand' pillar functionality with a specially crafted git url which could cause and arbitrary command to be run on the master with the same privileges as the master process...

SUSE CVE-2022-22934

An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. Salt Masters do not sign pillar data with the minion's public key, which can result in attackers substituting arbitrary pillar data...

PYSEC-2023-166

Salt masters prior to 3005.2 or 3006.2 contain a DOS in minion return. After receiving several bad packets on the request server equal to the number of worker threads, the master will become unresponsive to return requests until restarted...

SUSE CVE-2023-20897

Salt masters prior to 3005.2 or 3006.2 contain a DOS in minion return. After receiving several bad packets on the request server equal to the number of worker threads, the master will become unresponsive to return requests until restarted...

SUSE CVE-2018-15750

Directory Traversal vulnerability in salt-api in SaltStack Salt before 2017.7.8 and 2018.3.x before 2018.3.3 allows remote attackers to determine which files exist on the server...

SUSE CVE-2020-11651

An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class does not properly validate method calls. This allows a remote user to access some methods without authentication. These methods can be used to retrieve user tokens from the...

SUSE CVE-2021-21996

An issue was discovered in SaltStack Salt before 3003.3. A user who has control of the source, and sourcehash URLs can gain full file system access as root on a salt minion...

SUSE CVE-2021-25282

An issue was discovered in through SaltStack Salt before 3002.5. The salt.wheel.pillarroots.write method is vulnerable to directory traversal...

UBUNTU-CVE-2022-22941

An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. When configured as a Master-of-Masters, with a publisheracl, if a user configured in the publisheracl targets any minion connected to the Syndic, the Salt Master incorrectly interpreted no valid targets as valid,...

The vulnerability of the `salt.utils.thin.gen_thin()` function in the configuration management system and remote execution of SaltStack Salt operations allows a attacker to execute arbitrary commands on the target system.

The vulnerability of the salt.utils.thin.genthin function in the configuration management system and for remote execution of SaltStack Salt is related to insufficient validation of arguments passed in commands. Exploiting this vulnerability could allow a malicious actor to execute arbitrary...

PYSEC-2021-318

An issue was discovered in SaltStack Salt before 3003.3. A user who has control of the source, and sourcehash URLs can gain full file system access as root on a salt minion...

UBUNTU-CVE-2021-22004

An issue was discovered in SaltStack Salt before 3003.3. The salt minion installer will accept and use a minion config file at C:\salt\conf if that file is in place before the installer is run. This allows for a malicious actor to subvert the proper behaviour of the given minion software...

CVE-2021-3148

An issue was discovered in SaltStack Salt before 3002.5. Sending crafted web requests to the Salt API can result in salt.utils.thin.genthin command injection because of different handling of single versus double quotes. This is related to salt/utils/thin.py...

UBUNTU-CVE-2021-3197

An issue was discovered in SaltStack Salt before 3002.5. The salt-api's ssh client is vulnerable to a shell injection by including ProxyCommand in an argument, or via sshoptions provided in an API request...

UBUNTU-CVE-2020-28243

An issue was discovered in SaltStack Salt before 3002.5. The minion's restartcheck is vulnerable to command injection via a crafted process name. This allows for a local privilege escalation by any user able to create a files on the minion in a non-blacklisted directory...

UBUNTU-CVE-2021-25283

An issue was discovered in through SaltStack Salt before 3002.5. The jinja renderer does not protect against server side template injection attacks...

PYSEC-2021-54

In SaltStack Salt before 3002.5, eauth tokens can be used once after expiration. They might be used to run command against the salt master or minions...

VulnCheck KEV: CVE-2020-11651

SaltStack Salt contains an authentication bypass vulnerability in the salt-master process ClearFuncs due to improperly validating method calls. The vulnerability allows a remote user to access some methods without authentication, which can be used to retrieve user tokens from the salt master...