Multiple vulnerabilities in SaltStack Salt

Published: 2018-10-26

Risk	Low
Patch available	YES
Number of vulnerabilities	2
CVE-ID	CVE-2018-15750 CVE-2018-15751
CWE-ID	CWE-22 CWE-77
Exploitation vector	Network
Public exploit	N/A
Vulnerable software Subscribe	Salt Web applications / Remote management & hosting panels
Vendor	SaltStack

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Path traversal

EUVDB-ID: #VU15544

Risk: Low

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-15750

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Exploit availability: No

Description

The vulnerability allows a remote attacker to obtain potentially sensitive information.

The vulnerability exists due to insufficient validation of user-supplied input processed by the salt-api component. A remote attacker can send a query request that submits malicious input, conduct directory traversal attack and determine what files exist on the system, and this information can be used to conduct further attacks.

Mitigation

The vulnerability has been addressed in the versions 2017.7.8, 2018.3.3.

Vulnerable software versions

Salt: 2017.7.0 - 2018.3.2

External links

http://docs.saltstack.com/en/2017.7/topics/releases/2017.7.8.html
http://docs.saltstack.com/en/latest/topics/releases/2018.3.3.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Command injection

EUVDB-ID: #VU15545