Command injection in Salt - CVE-2018-15751

Vulnerability identifier: #VU15545

CSH Severity: Low

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-15751

CWE-ID: CWE-77

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary commands on the target system.

The vulnerability exists due to improper security restrictions imposed on the salt-api component. A remote attacker can use the salt-apicomponent to send a request that submits malicious input, bypass authentication and execute arbitrary commands on the system.

Salt
SUSE CaaS Platform
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE MicroOS
SUSE Enterprise Storage
Opensuse
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Server
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Module for Python2
SUSE Linux Enterprise Module for Server Applications
SUSE Linux Enterprise Module for Transactional Server
SUSE Linux Enterprise Module for Basesystem
Ubuntu
salt (Alpine package)
python3-distro
python2-distro
salt-minion (Ubuntu package)
salt-master (Ubuntu package)
salt-common (Ubuntu package)
salt-api (Ubuntu package)
salt-doc
salt-bash-completion
salt-fish-completion
salt-syndic
salt-standalone-formulas-configuration
salt-ssh
salt-proxy
salt-master
salt-zsh-completion
salt-api
python3-salt
salt
salt-cloud
salt-minion
salt-transactional-update
Dell EMC VxRail Appliance

The vulnerability has been addressed in the versions 2017.7.8, 2018.3.3.

Salt - addressed in versions 2017.7.8, 2018.3.3
salt (Alpine package) - update to 2018.3.3-r0
python3-distro - update to 1.5.0-3.5.1
python2-distro - update to 1.5.0-3.5.1
Dell EMC VxRail Appliance - update to 7.0.203
salt-minion (Ubuntu package) - addressed in versions 2015.8.8+ds-1ubuntu0.1, 2017.7.4+dfsg1-1ubuntu18.04.2
salt-master (Ubuntu package) - addressed in versions 2015.8.8+ds-1ubuntu0.1, 2017.7.4+dfsg1-1ubuntu18.04.2
salt-common (Ubuntu package) - addressed in versions 2015.8.8+ds-1ubuntu0.1, 2017.7.4+dfsg1-1ubuntu18.04.2
salt-api (Ubuntu package) - addressed in versions 2015.8.8+ds-1ubuntu0.1, 2017.7.4+dfsg1-1ubuntu18.04.2
salt-doc - update to 3002.2-37.1
salt-bash-completion - update to 3002.2-37.1
salt-fish-completion - update to 3002.2-37.1
salt-syndic - update to 3002.2-37.1
salt-standalone-formulas-configuration - update to 3002.2-37.1
salt-ssh - update to 3002.2-37.1
salt-proxy - update to 3002.2-37.1
salt-master - update to 3002.2-37.1
salt-zsh-completion - update to 3002.2-37.1
salt-api - update to 3002.2-37.1
python3-salt - update to 3002.2-37.1
salt - update to 3002.2-37.1
salt-cloud - update to 3002.2-37.1
salt-minion - update to 3002.2-37.1
salt-transactional-update - update to 3002.2-37.1

• https://docs.saltstack.com/en/2017.7/topics/releases/2017.7.8.html
• https://docs.saltstack.com/en/latest/topics/releases/2018.3.3.html

• Multiple vulnerabilities in SaltStack Salt
• OpenSUSE Linux update for salt
• OpenSUSE Linux update for salt
• OpenSUSE Linux update for salt
• Command injection in salt (Alpine package)
• SUSE update for salt
• SUSE update for salt
• Multiple vulnerabilities in Dell EMC VxRail Appliance
• Ubuntu update for salt