^{CVE-2020-11652:}Path Traversal Vulnerability in SaltStack Salt

Overview

This vulnerability (CWE-22: Path Traversal) affects the SaltStack Salt configuration management system. The issue lies in the salt-master process's ClearFuncs class, which contains methods that do not properly sanitize file paths. Authenticated users can exploit this vulnerability to access arbitrary directories on the system, potentially leading to unauthorized data access or disclosure of sensitive information. This vulnerability has been widely reported and affects multiple vendors who integrate SaltStack Salt into their products, including Cisco, VMware, and BlackBerry.

Remediation

To remediate this vulnerability, system administrators should:

1. Update SaltStack Salt to version 2019.2.4 or 3000.2 or later, which contain fixes for this vulnerability.
2. If immediate patching is not possible, consider implementing network-level controls to restrict access to the Salt master API.
3. Monitor Salt master logs for suspicious activity or unauthorized access attempts.
4. Follow vendor-specific guidance if using Salt as part of another product (such as VMware, Cisco, or BlackBerry products).
5. Consider implementing the principle of least privilege for Salt users to minimize potential impact.

References

• SaltStack Release Notes: https://docs.saltstack.com/en/latest/topics/releases/2019.2.4.html
• SaltStack 3000.2 Release Notes: https://github.com/saltstack/salt/blob/v3000.2_docs/doc/topics/releases/3000.2.rst
• VMware Security Advisory: http://www.vmware.com/security/advisories/VMSA-2020-0009.html
• Cisco Security Advisory: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-salt-2vx545AG
• BlackBerry Advisory: http://support.blackberry.com/kb/articleDetail?articleNumber=000063758
• Ubuntu Security Notice: https://usn.ubuntu.com/4459-1/
• Debian Security Advisory: https://www.debian.org/security/2020/dsa-4676
• Exploit Information: http://packetstormsecurity.com/files/157678/SaltStack-Salt-Master-Minion-Unauthenticated-Remote-Code-Execution.html