OS Command Injection in Salt - CVE-2020-16846

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU48204

OS Command Injection in Salt - CVE-2020-16846

Published: November 6, 2020 / Updated: December 12, 2022


Vulnerability identifier: #VU48204
CSH Severity: Medium
CVSS v4: 7.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-16846
CWE-ID: CWE-78
Exploitation vector: Remote access
Exploit availability: The vulnerability is being exploited in the wild

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation in SaltStack Salt when processing API requests. A remote attacker can send specially crafted request to the server and execute arbitrary OS commands on the target system.

Successful exploitation of the vulnerability requires that SSH client is enabled.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


Affected software

Salt
Arch Linux
Gentoo Linux
Ubuntu
Opensuse
Fedora
salt (Alpine package)
salt (Debian package)
salt-common (Ubuntu package)
salt-minion (Ubuntu package)
salt

How to mitigate CVE-2020-16846

Install updates from vendor's website.

Salt - addressed in versions 2019.2.6, 2019.2.7, 3000.4, 3000.5, 3001.2, 3001.3, 3002.1
salt (Alpine package) - update to 3002-r1
salt (Debian package) - update to 2018.3.4+dfsg1-6+deb10u2
salt-common (Ubuntu package) - addressed in versions Ubuntu Pro, salt-master
salt-minion (Ubuntu package) - update to salt-ssh
salt - addressed in versions 3001.3-1.fc31, 3001.3-1.fc32, 3002.1-1.fc33

Links to Public Exploits and PoC-codes

External References

Related Security Bulletins