Path traversal in Salt - CVE-2018-15750

Vulnerability identifier: #VU15544

CSH Severity: Low

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-15750

CWE-ID: CWE-22

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to obtain potentially sensitive information.

The vulnerability exists due to insufficient validation of user-supplied input processed by the salt-api component. A remote attacker can send a query request that submits malicious input, conduct directory traversal attack and determine what files exist on the system, and this information can be used to conduct further attacks.

Salt
SUSE CaaS Platform
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE MicroOS
SUSE Enterprise Storage
Opensuse
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Server
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Module for Python2
SUSE Linux Enterprise Module for Server Applications
SUSE Linux Enterprise Module for Transactional Server
SUSE Linux Enterprise Module for Basesystem
Ubuntu
salt (Alpine package)
python3-distro
python2-distro
salt-minion (Ubuntu package)
salt-master (Ubuntu package)
salt-common (Ubuntu package)
salt-api (Ubuntu package)
salt-doc
salt-bash-completion
salt-fish-completion
salt-syndic
salt-standalone-formulas-configuration
salt-ssh
salt-proxy
salt-master
salt-zsh-completion
salt-api
python3-salt
salt
salt-cloud
salt-minion
salt-transactional-update
Dell EMC VxRail Appliance

The vulnerability has been addressed in the versions 2017.7.8, 2018.3.3.

Salt - addressed in versions 2017.7.8, 2018.3.3
salt (Alpine package) - update to 2018.3.3-r0
python3-distro - update to 1.5.0-3.5.1
python2-distro - update to 1.5.0-3.5.1
Dell EMC VxRail Appliance - update to 7.0.203
salt-minion (Ubuntu package) - addressed in versions 2015.8.8+ds-1ubuntu0.1, 2017.7.4+dfsg1-1ubuntu18.04.2
salt-master (Ubuntu package) - addressed in versions 2015.8.8+ds-1ubuntu0.1, 2017.7.4+dfsg1-1ubuntu18.04.2
salt-common (Ubuntu package) - addressed in versions 2015.8.8+ds-1ubuntu0.1, 2017.7.4+dfsg1-1ubuntu18.04.2
salt-api (Ubuntu package) - addressed in versions 2015.8.8+ds-1ubuntu0.1, 2017.7.4+dfsg1-1ubuntu18.04.2
salt-doc - update to 3002.2-37.1
salt-bash-completion - update to 3002.2-37.1
salt-fish-completion - update to 3002.2-37.1
salt-syndic - update to 3002.2-37.1
salt-standalone-formulas-configuration - update to 3002.2-37.1
salt-ssh - update to 3002.2-37.1
salt-proxy - update to 3002.2-37.1
salt-master - update to 3002.2-37.1
salt-zsh-completion - update to 3002.2-37.1
salt-api - update to 3002.2-37.1
python3-salt - update to 3002.2-37.1
salt - update to 3002.2-37.1
salt-cloud - update to 3002.2-37.1
salt-minion - update to 3002.2-37.1
salt-transactional-update - update to 3002.2-37.1

• https://docs.saltstack.com/en/2017.7/topics/releases/2017.7.8.html
• https://docs.saltstack.com/en/latest/topics/releases/2018.3.3.html

• Multiple vulnerabilities in SaltStack Salt
• OpenSUSE Linux update for salt
• OpenSUSE Linux update for salt
• OpenSUSE Linux update for salt
• Path traversal in salt (Alpine package)
• SUSE update for salt
• SUSE update for salt
• Multiple vulnerabilities in Dell EMC VxRail Appliance
• Ubuntu update for salt