CVE-2020-25592: SaltStack Salt authentication bypass in salt-netapi

CVE-2020-25592 · Severity: low · CVSS 3.1 · Published 2020-11-06

SaltStack Salt is a widely-used open-source infrastructure automation and configuration management platform. The salt-netapi component improperly validates authentication credentials and tokens, allowing an unauthenticated attacker to bypass authentication and execute arbitrary commands via Salt SSH. This could lead to complete compromise of managed systems and data exposure.

Technologies: salt (PyPI), Saltstack Salt. Vendors: PyPI, Saltstack.

Quick answers

Is CVE-2020-25592 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2020-25592 being exploited in the wild.
How severe is CVE-2020-25592?
Low severity, with a CVSS score of 3.1, published 6 November 2020.
Which products and versions are affected?
salt (PyPI) ECOSYSTEM:introduced=0,fixed=2015.8.10,introduced=2015.8.11,fixed=2015.8.13,introduced=2016.3.0,fixed=2016.3.4,introduced=2016.3.5,fixed=2016.3.6,introduced=2016.3.7,fixed=2016.3.8,introduced=2016.11.0,fixed=2016.11.3,introduced=2016.11.4,fixed=2016.11.6,introduced=2016.11.7,fixed=2016.11.10,introduced=2017.7.0,fixed=2017.7.4,introduced=2017.7.5,fixed=2017.7.8,introduced=2018.3.0rc1,fixed=2018.3.5,introduced=2019.2.0,fixed=2019.2.5,introduced=3000,fixed=3000.3; Saltstack Salt before 2015.8.13, 2016.3.0 before 2016.3.8, 2016.11.0 before 2016.11.10, 2017.7.0 before 2017.7.8, 2018.3.0 before 2018.3.5, 2019.2.0 before 2019.2.7, 3000.x before 3000.5, 3001.x before 3001.3, 3002.x before 3002.1.
Is there a fix for CVE-2020-25592?
Yes. salt (PyPI): upgrade to 3000.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2020-25592 attacked?
It is attacked over the network.
Am I affected by CVE-2020-25592?
Check whether you run salt (PyPI) or Saltstack Salt at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • salt (PyPI): upgrade to 3000.3 or later
    pip install "salt>=3000.3"

Technical details

This vulnerability is an authentication bypass (CWE-20: Improper Input Validation) in the salt-netapi REST API component. The flaw allows attackers to bypass eauth credential and token validation without proper authentication, gaining access to invoke Salt SSH commands. The attack vector is network-based and requires no authentication or user interaction. An attacker can leverage this to execute arbitrary commands on systems managed by the affected Salt installation. Patches are available in multiple release branches (2015.8.13, 2016.3.8, 2016.11.10, 2017.7.8, 2018.3.5, 2019.2.7, and later versions).

Affected products

  • SaltStack Salt before 2015.8.13, 2016.3.0 before 2016.3.8, 2016.11.0 before 2016.11.10, 2017.7.0 before 2017.7.8, 2018.3.0 before 2018.3.5, 2019.2.0 before 2019.2.7, 3000.x before 3000.5, 3001.x before 3001.3, 3002.x before 3002.1

Identifiers

  • CVE-2020-25592
  • GHSA-29j3-2446-5j4w
  • PYSEC-2020-106

Timeline

  • 2020-11-06: disclosed: Vulnerability publicly disclosed
  • 2020-11: patched: Patches released across multiple release branches

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.