Executive brief
SaltStack Salt is a configuration management and infrastructure automation platform widely used to manage servers at scale. A path traversal vulnerability in the Salt file server allows authenticated attackers to read arbitrary files from the Salt master's filesystem by crafting a specially designed URL, potentially exposing sensitive configuration data, credentials, and other confidential information.
Technical details
The vulnerability is a path traversal (CWE-22) in the Salt file server's find_file function. The root cause involves inadequate validation of file paths, particularly insufficient checks for absolute paths and directory traversal sequences (../) that were previously removed. The attack requires an authenticated user with access to the file server and is network-reachable. An attacker can exploit this by crafting malicious URLs containing path traversal payloads to read arbitrary files outside the intended serving directory on the Salt master. The fix was implemented in version 3005.5 and 3006.6, removing faulty validation logic and replacing it with proper URL escape handling.
Affected products
- SaltStack Salt Before 3005.5 and before 3006.6
Timeline
- 2024-06-27: disclosed: Published as GHSA-2qw3-2wv6-p64x
- 2024-01-24: patched: Fix committed to salt repository