Log in Start free

Actively exploited · Published Nov 6, 2020 · Assigned by mitre

CVE-2020-16846

Critical 9.8 Exploited

In plain English

A critical-severity OS command injection in Salt from SaltStack. Attackers are actively exploiting it in the wild (listed by CISA on November 3, 2021). The chance it is exploited in the next 30 days is estimated at 99.6% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei, public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)99.6%top 0.1% of all CVEs
Exploited in the wildYesCISA KEV since Nov 3, 2021
Attack tooling3Metasploit, Nuclei, Public PoC

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by May 3, 2022.

Official description

An issue was discovered in SaltStack Salt through 3002. Sending crafted web requests to the Salt API, with the SSH client enabled, can result in shell injection.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20salt3002-r1ALPINE-CVE-2020-16846
Alpine:v3.21salt3002-r1ALPINE-CVE-2020-16846
Alpine:v3.22salt3002-r1ALPINE-CVE-2020-16846
Alpine:v3.23salt3002-r1ALPINE-CVE-2020-16846
Alpine:v3.24salt3002-r1ALPINE-CVE-2020-16846
PyPIsalt2015.8.13GHSA-qr38-h96j-2j3w
PyPIsalt2016.3.8GHSA-qr38-h96j-2j3w
PyPIsalt2016.11.10GHSA-qr38-h96j-2j3w
PyPIsalt2017.7.8GHSA-qr38-h96j-2j3w
PyPIsalt2018.3.5GHSA-qr38-h96j-2j3w
PyPIsalt2019.2.6GHSA-qr38-h96j-2j3w
PyPIsalt3000.4GHSA-qr38-h96j-2j3w
PyPIsalt3001.2GHSA-qr38-h96j-2j3w
PyPIsalt3002.1GHSA-qr38-h96j-2j3w
PyPIsalt2015.8.10, 2015.8.13, 2016.11.10, 2016.11.3, 2016.11.6, 2016.3.4, 2016.3.6, 2016.3.8, 2017.7.4, 2017.7.8, 2018.3.5, 2019.2.5, 3000.3PYSEC-2020-104

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References