Actively exploited · Published Apr 30, 2020 · Assigned by mitre
CVE-2020-11652
Medium 6.5 Exploited
In plain English
A medium-severity path traversal in Salt from SaltStack. Attackers are actively exploiting it in the wild (listed by CISA on November 3, 2021). The chance it is exploited in the next 30 days is estimated at 86.2% (higher than 99.7% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, public proof-of-concept code. Fixed versions are available - upgrade the affected package.
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by May 3, 2022.
Official description
An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class allows access to some methods that improperly sanitize paths. These methods allow arbitrary directory access to authenticated users.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | salt | 3000.2-r0 | ALPINE-CVE-2020-11652 |
| Alpine:v3.21 | salt | 3000.2-r0 | ALPINE-CVE-2020-11652 |
| Alpine:v3.22 | salt | 3000.2-r0 | ALPINE-CVE-2020-11652 |
| Alpine:v3.23 | salt | 3000.2-r0 | ALPINE-CVE-2020-11652 |
| Alpine:v3.24 | salt | 3000.2-r0 | ALPINE-CVE-2020-11652 |
| PyPI | salt | 2019.2.4 | GHSA-vp49-2g4r-m3x3 |
| PyPI | salt | 3000.2 | GHSA-vp49-2g4r-m3x3 |
| PyPI | salt | 2019.2.4, 3000.2 | PYSEC-2020-103 |
Affected products (as reported)
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
References
- https://docs.saltstack.com/en/latest/topics/releases/2019.2.4.html x_refsource_MISC
- https://github.com/saltstack/salt/blob/v3000.2_docs/doc/topics/releases/3000.2.rst x_refsource_MISC
- openSUSE-SU-2020:0564 vendor-advisory, x_refsource_SUSE
- http://packetstormsecurity.com/files/157560/Saltstack-3000.1-Remote-Code-Execution.html x_refsource_MISC
- DSA-4676 vendor-advisory, x_refsource_DEBIAN
- http://www.vmware.com/security/advisories/VMSA-2020-0009.html x_refsource_CONFIRM
- http://packetstormsecurity.com/files/157678/SaltStack-Salt-Master-Minion-Unauthenticated-Remote-Code-Execution.html x_refsource_MISC
- 20200528 SaltStack FrameWork Vulnerabilities Affecting Cisco Products vendor-advisory, x_refsource_CISCO
- [debian-lts-announce] 20200530 [SECURITY] [DLA 2223-1] salt security update mailing-list, x_refsource_MLIST
- http://support.blackberry.com/kb/articleDetail?articleNumber=000063758 x_refsource_MISC
- openSUSE-SU-2020:1074 vendor-advisory, x_refsource_SUSE
- USN-4459-1 vendor-advisory, x_refsource_UBUNTU
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-11652 government-resource