Published: 27/02/2021 Updated: 21/12/2023

CVSS v2 Base Score: 4.4 | Impact Score: 6.4 | Exploitability Score: 3.4

CVSS v3 Base Score: 7.8 | Impact Score: 5.9 | Exploitability Score: 1.8

VMScore: 392

Vector: AV:L/AC:M/Au:N/C:P/I:P/A:P

An issue exists in SaltStack Salt prior to 3002.5. The minion's restartcheck is vulnerable to command injection via a crafted process name. This allows for a local privilege escalation by any user able to create a files on the minion in a non-blacklisted directory.

Vulnerable Product	Search on Vulmon	Subscribe to Product
saltstack salt
fedoraproject fedora 32
fedoraproject fedora 33
fedoraproject fedora 34
debian debian linux 9.0
debian debian linux 10.0
debian debian linux 11.0

Debian Bug report logs - #983632 salt: CVE-2020-28243 CVE-2020-28972 CVE-2020-35662 CVE-2021-3148 CVE-2021-3144 CVE-2021-25281 CVE-2021-25282 CVE-2021-25283 CVE-2021-25284 CVE-2021-3197 Package: src:salt; Maintainer for src:salt is Debian Salt Team <pkg-salt-team@alioth-listsdebiannet>; Reported by: Salvatore Bonaccorso &lt ...

Multiple security vulnerabilities have been discovered in Salt, a powerful remote execution manager, that allow for local privilege escalation on a minion, server side template injection attacks, insufficient checks for eauth credentials, shell and command injections or incorrect validation of SSL certificates For the oldstable distribution (buste ...

A security issue was found in SaltStack before versions 30025, 30016 and 30008 A privilege escalation is possible on a SaltStack minion when an unprivileged user is able to create files in any non-blacklisted directory via a command injection in a process name ...

CVE-2020-28243 Local Privledge Escalation Exploit in SaltStack Minion

CVE-2020-28243 A command injection vulnerability in SaltStack's Salt allows for privilege escalation via specially crafted process names on a minion when the master calls restartcheck For a full writeup please see this blog post Affected Versions: All versions between 201630rc2 and 30022 Links: Mitre, NVD Requirements For this exploit to work the following are needed:

Proof of concept code published for latest Saltstack CVE: Don't be an update laggard

The Register • Gareth Corfield • 03 Mar 2021

Any user could become root, warns Immersive Labs researcher More Salt in their wounds: DigiCert hit as hackers wriggle through (patched) holes in buggy config tool

Proof of concept code has been published for a vulnerability in popular data centre security management tool Saltstack, which was discovered after a developer at Immersive Labs found a privilege escalation bug allowing any old user to become root. SaltStack offers open-source, Python-based automation tools and was acquired by VMware in October last year. The latest CVE is a command injection flaw leading to the priv-esc flaw, according to Immersive Labs, whose Matt Rollings found the vuln. Numbe...

CVE-2020-28243

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Github Repositories

Recent Articles

References

Vulmon Search

About

Products

Connect