CVE-2020-16846criticalunder attackCWE-78

CVE-2020-16846

Published · Updated

Follow this CVE+ Monitor SaltStack+ Monitor salt

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.8epss 100%
from disclosure to weapon342 days
Published on NVDNov 6
1st PoC+342d
metasploitNov 3
CISA KEV+362d
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Affected
1 product (2 components)
Red Hat Ceph Storage 2
workaround: Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update as soon as possible.
Action required by CISAfederal deadline: 2022-05-03

Apply updates per vendor instructions.

In short

SaltStack Salt has a shell injection vulnerability in its web API when SSH is enabled. An attacker can send specially crafted requests to execute arbitrary commands on the server.

Technical detail

CWE-78 shell injection in SaltStack Salt API (≤3002) allows unauthenticated remote code execution when SSH client is enabled. The vulnerability exists in request handling that fails to properly sanitize inputs before passing them to shell execution, enabling command injection via crafted HTTP requests.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

An issue was discovered in SaltStack Salt through 3002. Sending crafted web requests to the Salt API, with the SSH client enabled, can result in shell injection.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · n/a
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.