CVE-2020-11651criticalunder attack

CVE-2020-11651

Published · Updated

Follow this CVE+ Monitor SaltStack+ Monitor salt

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.8epss 97%
from disclosure to weapon1 day
Published on NVDApr 30
1st PoC+1d
metasploitApr 30
CISA KEV+552d
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Affected
1 product (2 components)
Red Hat Ceph Storage 2
workaround: Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update as soon as possible.
Action required by CISAfederal deadline: 2022-05-03

Apply updates per vendor instructions.

In short

SaltStack Salt's master process fails to properly check who is calling certain functions, allowing remote attackers to access it without a password. This can be used to steal authentication tokens or run harmful commands on connected servers.

Technical detail

The ClearFuncs class in salt-master lacks proper authentication validation for method invocations, enabling unauthenticated remote access to sensitive functions. An attacker can exploit this to exfiltrate user tokens and execute arbitrary code on salt minions via the exposed API surface.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class does not properly validate method calls. This allows a remote user to access some methods without authentication. These methods can be used to retrieve user tokens from the salt master and/or run arbitrary commands on salt minions.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · n/a
public PoCs found — 37
exploitdbwww.exploit-db.com/exploits/48421unverifiedgithubgithub.com/jasperla/CVE-2020-11651-poc★ 123githubgithub.com/rossengeorgiev/salt-security-backports★ 109githubgithub.com/dozernz/cve-2020-11651★ 106githubgithub.com/0xc0d/CVE-2020-11651★ 40githubgithub.com/ssrsec/CVE-2020-11651-CVE-2020-11652-EXP★ 24githubgithub.com/kevthehermit/CVE-2020-11651★ 6githubgithub.com/chef-cft/salt-vulnerabilities★ 6githubgithub.com/bravery9/SaltStack-Exp★ 5githubgithub.com/lovelyjuice/cve-2020-11651-exp-plus★ 5githubgithub.com/appcheck-ng/salt-rce-scanner-CVE-2020-11651-CVE-2020-11652★ 2githubgithub.com/Drew-Alleman/CVE-2020-11651★ 1githubgithub.com/RakhithJK/CVE-2020-11651★ 0githubgithub.com/CyberCTF/vulhub-saltstack-cve-2020-11651★ 0githubgithub.com/codenamepetrel/salt-cve-2020-11651-poc★ 0githubgithub.com/s1lentf00thold/CVE-2020-11651-Poc★ 0githubgithub.com/hardsoftsecurity/CVE-2020-11651-PoC★ 0cve_referencepacketstormsecurity.com/files/157678/SaltStack-Salt-Master-Minion-Unauthenticated-Remote-Code-Execution.htmlunverifiedvulncheckvulncheck.com/xdb/9c4aba6c26caunverifiedcve_referencepacketstormsecurity.com/files/157560/Saltstack-3000.1-Remote-Code-Execution.htmlunverifiedvulncheckvulncheck.com/xdb/9b2e9c57cc2funverifiedvulncheckvulncheck.com/xdb/9eca9d3ac7fcunverifiedvulncheckvulncheck.com/xdb/af41527f8240unverifiedvulncheckvulncheck.com/xdb/aaa9b5889efaunverifiedvulncheckvulncheck.com/xdb/51575fb7e19dunverifiedvulncheckvulncheck.com/xdb/731f17c6b531unverifiedvulncheckvulncheck.com/xdb/25e4169b7213unverifiedvulncheckvulncheck.com/xdb/ed4dc5fcce7funverifiedvulncheckvulncheck.com/xdb/f1a425abf2c5unverifiedvulncheckvulncheck.com/xdb/f2d4106b8900unverifiedvulncheckvulncheck.com/xdb/6941178da516unverifiedvulncheckvulncheck.com/xdb/126bde061e76unverifiedvulncheckvulncheck.com/xdb/8e2c5b54e098unverifiedvulncheckvulncheck.com/xdb/ad2b3134eaadunverifiedvulncheckvulncheck.com/xdb/605b3d9a1c77unverifiedvulncheckvulncheck.com/xdb/9705a4dc0d5dunverifiedvulncheckvulncheck.com/xdb/20496291ec6eunverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.