Path traversal in Salt - CVE-2024-22232

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU86612

Path traversal in Salt - CVE-2024-22232

Published: February 20, 2024


Vulnerability identifier: #VU86612
CSH Severity: Medium
CVSS v4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N]
CVE-ID: CVE-2024-22232
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote user to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences. A remote user can send a specially crafted HTTP request and read arbitrary files Salt master’s filesystem.


Affected software

Salt
Gentoo Linux
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Desktop 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Manager Proxy Module
SUSE Manager Server Module
SUSE Manager Client Tools for SLE Micro
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Micro for Rancher
openSUSE Leap Micro
SUSE Enterprise Storage
SUSE Manager Client Tools for RHEL, Liberty and Clones
SUSE Manager Client Tools for Debian
SUSE Manager Client Tools for SLE
SUSE Linux Enterprise Server for the Raspberry Pi
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Desktop
SUSE Linux Enterprise Server 15 SP1 LTSS
SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP3 LTSS
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Server 15 SP4 LTSS
SUSE Linux Enterprise Desktop 15 SP4 LTSS
Server Applications Module
Basesystem Module
Transactional Server Module
openSUSE Leap
SUSE Manager Client Tools for Ubuntu 20.04
SUSE Manager Client Tools for Ubuntu 22.04
scap-security-guide-ubuntu
release-notes-susemanager-proxy
release-notes-susemanager
spacecmd
salt-common
salt-minion
venv-salt-minion
salt-master
salt-api
python3-salt
salt
salt-ssh
salt-transactional-update
salt-standalone-formulas-configuration
salt-cloud
salt-proxy
salt-syndic
salt-fish-completion
salt-zsh-completion
salt-bash-completion
salt-doc
python3-salt-testsuite
app-admin/salt
Session Smart Router

How to mitigate CVE-2024-22232

Install update from vendor's website.

Salt - addressed in versions 3005.5, 3006.6
scap-security-guide-ubuntu - update to 0.1.71-2.41.2
release-notes-susemanager-proxy - update to 4.3.11-150400.3.79.1
release-notes-susemanager - update to 4.3.11-150400.3.100.1
spacecmd - update to 4.3.27-2.81.2
Session Smart Router - addressed in versions 6.2.10, 6.3.7
salt-common - update to 3006.0+ds-1+2.122.2
salt-minion - addressed in versions 3006.0+ds-1+2.122.2, 3006.0-150100.117.1, 3006.0-150200.118.1, 3006.0-150300.53.70.1, 3006.0-150400.8.54.1, 3006.0-150500.4.29.1
venv-salt-minion - addressed in versions 3006.0-1.36.3, 3006.0-2.12.3, 3006.0-2.43.3, 3006.0-2.50.4, 3006.0-2.52.3, 3006.0-3.52.3, 3006.0-150000.3.54.3
salt-master - addressed in versions 3006.0-150100.117.1, 3006.0-150200.118.1, 3006.0-150300.53.70.1, 3006.0-150400.8.54.1, 3006.0-150500.4.29.1
salt-api - addressed in versions 3006.0-150100.117.1, 3006.0-150200.118.1, 3006.0-150300.53.70.1, 3006.0-150400.8.54.1, 3006.0-150500.4.29.1
python3-salt - addressed in versions 3006.0-150100.117.1, 3006.0-150200.118.1, 3006.0-150300.53.70.1, 3006.0-150400.8.54.1, 3006.0-150500.4.29.1
salt - addressed in versions 3006.0-150100.117.1, 3006.0-150200.118.1, 3006.0-150300.53.70.1, 3006.0-150400.8.54.1, 3006.0-150500.4.29.1
salt-ssh - addressed in versions 3006.0-150100.117.1, 3006.0-150200.118.1, 3006.0-150300.53.70.1, 3006.0-150400.8.54.1, 3006.0-150500.4.29.1
salt-transactional-update - addressed in versions 3006.0-150100.117.1, 3006.0-150200.118.1, 3006.0-150300.53.70.1, 3006.0-150400.8.54.1, 3006.0-150500.4.29.1
salt-standalone-formulas-configuration - addressed in versions 3006.0-150100.117.1, 3006.0-150200.118.1, 3006.0-150300.53.70.1, 3006.0-150400.8.54.1, 3006.0-150500.4.29.1
salt-cloud - addressed in versions 3006.0-150100.117.1, 3006.0-150200.118.1, 3006.0-150300.53.70.1, 3006.0-150400.8.54.1, 3006.0-150500.4.29.1
salt-proxy - addressed in versions 3006.0-150100.117.1, 3006.0-150200.118.1, 3006.0-150300.53.70.1, 3006.0-150400.8.54.1, 3006.0-150500.4.29.1
salt-syndic - addressed in versions 3006.0-150100.117.1, 3006.0-150200.118.1, 3006.0-150300.53.70.1, 3006.0-150400.8.54.1, 3006.0-150500.4.29.1
salt-fish-completion - addressed in versions 3006.0-150100.117.1, 3006.0-150200.118.1, 3006.0-150300.53.70.1, 3006.0-150400.8.54.1, 3006.0-150500.4.29.1
salt-zsh-completion - addressed in versions 3006.0-150100.117.1, 3006.0-150200.118.1, 3006.0-150300.53.70.1, 3006.0-150400.8.54.1, 3006.0-150500.4.29.1
salt-bash-completion - addressed in versions 3006.0-150100.117.1, 3006.0-150200.118.1, 3006.0-150300.53.70.1, 3006.0-150400.8.54.1, 3006.0-150500.4.29.1
salt-doc - addressed in versions 3006.0-150100.117.1, 3006.0-150200.118.1, 3006.0-150300.53.70.1, 3006.0-150400.8.54.1, 3006.0-150500.4.29.1
python3-salt-testsuite - addressed in versions 3006.0-150300.53.70.1, 3006.0-150400.8.54.1, 3006.0-150500.4.29.1
app-admin/salt - update to 3006.6

External References

Related Security Bulletins