Executive brief
SaltStack Salt is an automation and configuration management platform used to manage large numbers of servers. A vulnerability in how the central 'master' server validates the identity of connecting 'minion' agents allows an attacker to bypass authentication. This could allow an unauthorized party to gain control over the management server, potentially leading to full system compromise or data theft across the managed infrastructure.
Technical details
A directory traversal vulnerability exists in the minion ID validation logic of SaltStack Salt. By crafting a minion ID containing path traversal sequences (e.g., '../'), a remote attacker can bypass credential validation and successfully authenticate to a Salt master. This occurs because the software fails to properly neutralize special elements within the pathname used to identify the minion. An attacker can exploit this over the network without prior authentication or user interaction to gain unauthorized access to the master server. The issue was addressed by introducing a 'clean_id' validation function in salt.utils.verify.py.
Affected products
- SaltStack Salt < 2016.11.7, >= 2017.7.0, < 2017.7.1
Timeline
- 2017-08-15: patched: Fix merged into SaltStack repository
- 2017-08-23: advisory: NVD published CVE-2017-12791
- 2022-05-17: disclosed: GitHub Advisory published