SaltStack Salt Master Authentication Bypass
- Product
- SaltStack Salt
- CVE
- CVE-2020-11651CVE-2020-11652
- Disclosed
- 2020-04-30
- CVSS
- 9.8
- Auth
- pre-auth
- CISA KEV
- yes
- Affected
- Salt < 2019.2.4 and 3000 < 3000.2
- Fixed
- 2019.2.4, 3000.2
Summary
F-Secure found that the Salt master's request server exposed internal methods without authentication. Attackers could steal the root key and push commands to every managed minion; mass exploitation hit LineageOS, Ghost, DigiCert and others within days.
Root cause
The ClearFuncs class on the master's ZeroMQ request server (port 4506) did not restrict which methods unauthenticated clients could call. Methods like _prep_auth_info leaked the root key, and _send_pub published arbitrary jobs to minions; CVE-2020-11652 added path traversal for arbitrary file read/write on the master.
Impact
Unauthenticated remote code execution as root on the Salt master and every connected minion.
Detection
Scan for internet-exposed ports 4505/4506; check salt-master version; review master logs for unexpected key access and job publications.
Mitigation
Upgrade to 2019.2.4/3000.2+ and never expose the Salt master to the internet.