Executive brief
SaltStack Salt is an open-source infrastructure automation tool used by organizations to manage and provision servers at scale. A flaw in how pillar data (configuration and credentials) is transmitted from the server to clients allows an attacker positioned between them to intercept and substitute arbitrary pillar data without detection. An attacker exploiting this could inject malicious packages, credentials, or keys to compromise client machines.
Technical details
SaltStack Salt versions before 3002.8, 3003.4, and 3004.1 fail to cryptographically sign pillar data with the minion's public key, violating the integrity requirement for sensitive configuration. The vulnerability exists in the symmetric channel protocol variation used for pillar messages: neither the freshly generated encryption key nor the message payload is authenticated as originating from the server, enabling a man-in-the-middle attacker to forge and inject arbitrary pillar data if they know the client's public key (which is broadcast during key exchange). This affects all prior versions up to the fixed releases. The fix adds a server signature to pillar messages to prevent spoofing.
Affected products
- SaltStack Salt before 3002.8, 3003.4, 3004.1
Timeline
- 2022-03-30: disclosed
- 2022-03-28: patched: Patch released adding server signature to pillar messages