CVE-2020-16846
SaltStack Salt Shell Injection Vulnerability
Severity Score
9.8
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
1
*Multiple Sources
Exploited in Wild
Yes
*KEV
Decision
-
*SSVC
Descriptions
An issue was discovered in SaltStack Salt through 3002. Sending crafted web requests to the Salt API, with the SSH client enabled, can result in shell injection.
Se detectó un problema en SaltStack Salt versiones hasta 3002. El envío de peticiones web diseñadas a la Salt API, con el cliente SSH habilitado, puede resultar en una inyección shell
This vulnerability allows remote attackers to execute arbitrary code on affected installations of SaltStack Salt. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the rest_cherrypy module. When parsing the ssh_remote_port_forwards parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the salt-api process.
SaltStack Salt allows an unauthenticated user with network access to the Salt API to use shell injections to run code on the Salt API using the SSH client. This vulnerability affects any users running the Salt API.
*Credits:
KPC of Trend Micro Zero Day Initiative
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2020-08-04 CVE Reserved
- 2020-11-06 CVE Published
- 2021-10-26 First Exploit
- 2021-11-03 Exploited in Wild
- 2022-05-03 KEV Due Date
- 2024-08-04 CVE Updated
- 2024-11-13 EPSS Updated
CWE
- CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CAPEC
References (15)
| URL | Tag | Source |
|---|---|---|
| http://packetstormsecurity.com/files/160039/SaltStack-Salt-REST-API-Arbitrary-Command-Execution.html | Third Party Advisory |
|
| https://github.com/saltstack/salt/releases | Third Party Advisory | |
| https://lists.debian.org/debian-lts-announce/2020/12/msg00007.html | Mailing List |
|
| https://lists.debian.org/debian-lts-announce/2022/01/msg00000.html | Mailing List |
|
| https://www.zerodayinitiative.com/advisories/ZDI-20-1379 | Third Party Advisory |
|
| https://www.zerodayinitiative.com/advisories/ZDI-20-1380 | Third Party Advisory |
|
| https://www.zerodayinitiative.com/advisories/ZDI-20-1381 | Third Party Advisory |
|
| https://www.zerodayinitiative.com/advisories/ZDI-20-1382 | Third Party Advisory |
|
| https://www.zerodayinitiative.com/advisories/ZDI-20-1383 | Third Party Advisory |
|
| URL | Date | SRC |
|---|---|---|
| https://github.com/zomy22/CVE-2020-16846-Saltstack-Salt-API | 2021-10-26 |
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Saltstack Search vendor "Saltstack" | Salt Search vendor "Saltstack" for product "Salt" | < 2015.8.10 Search vendor "Saltstack" for product "Salt" and version " < 2015.8.10" | - |
Affected
| ||||||
| Saltstack Search vendor "Saltstack" | Salt Search vendor "Saltstack" for product "Salt" | >= 2015.8.11 < 2015.8.13 Search vendor "Saltstack" for product "Salt" and version " >= 2015.8.11 < 2015.8.13" | - |
Affected
| ||||||
| Saltstack Search vendor "Saltstack" | Salt Search vendor "Saltstack" for product "Salt" | >= 2016.3.0 < 2016.3.4 Search vendor "Saltstack" for product "Salt" and version " >= 2016.3.0 < 2016.3.4" | - |
Affected
| ||||||
| Saltstack Search vendor "Saltstack" | Salt Search vendor "Saltstack" for product "Salt" | >= 2016.3.5 < 2016.3.6 Search vendor "Saltstack" for product "Salt" and version " >= 2016.3.5 < 2016.3.6" | - |
Affected
| ||||||
| Saltstack Search vendor "Saltstack" | Salt Search vendor "Saltstack" for product "Salt" | >= 2016.3.7 < 2016.3.8 Search vendor "Saltstack" for product "Salt" and version " >= 2016.3.7 < 2016.3.8" | - |
Affected
| ||||||
| Saltstack Search vendor "Saltstack" | Salt Search vendor "Saltstack" for product "Salt" | >= 2016.11.0 < 2016.11.3 Search vendor "Saltstack" for product "Salt" and version " >= 2016.11.0 < 2016.11.3" | - |
Affected
| ||||||
| Saltstack Search vendor "Saltstack" | Salt Search vendor "Saltstack" for product "Salt" | >= 2016.11.4 < 2016.11.6 Search vendor "Saltstack" for product "Salt" and version " >= 2016.11.4 < 2016.11.6" | - |
Affected
| ||||||
| Saltstack Search vendor "Saltstack" | Salt Search vendor "Saltstack" for product "Salt" | >= 2016.11.7 < 2016.11.10 Search vendor "Saltstack" for product "Salt" and version " >= 2016.11.7 < 2016.11.10" | - |
Affected
| ||||||
| Saltstack Search vendor "Saltstack" | Salt Search vendor "Saltstack" for product "Salt" | >= 2017.5.0 < 2017.7.4 Search vendor "Saltstack" for product "Salt" and version " >= 2017.5.0 < 2017.7.4" | - |
Affected
| ||||||
| Saltstack Search vendor "Saltstack" | Salt Search vendor "Saltstack" for product "Salt" | >= 2017.7.5 < 2017.7.8 Search vendor "Saltstack" for product "Salt" and version " >= 2017.7.5 < 2017.7.8" | - |
Affected
| ||||||
| Saltstack Search vendor "Saltstack" | Salt Search vendor "Saltstack" for product "Salt" | >= 2018.2.0 < 2018.3.5 Search vendor "Saltstack" for product "Salt" and version " >= 2018.2.0 < 2018.3.5" | - |
Affected
| ||||||
| Saltstack Search vendor "Saltstack" | Salt Search vendor "Saltstack" for product "Salt" | >= 2019.2.0 < 2019.2.5 Search vendor "Saltstack" for product "Salt" and version " >= 2019.2.0 < 2019.2.5" | - |
Affected
| ||||||
| Saltstack Search vendor "Saltstack" | Salt Search vendor "Saltstack" for product "Salt" | >= 3000.0 < 3000.3 Search vendor "Saltstack" for product "Salt" and version " >= 3000.0 < 3000.3" | - |
Affected
| ||||||
| Saltstack Search vendor "Saltstack" | Salt Search vendor "Saltstack" for product "Salt" | 3001 Search vendor "Saltstack" for product "Salt" and version "3001" | - |
Affected
| ||||||
| Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 9.0 Search vendor "Debian" for product "Debian Linux" and version "9.0" | - |
Affected
| ||||||
| Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 10.0 Search vendor "Debian" for product "Debian Linux" and version "10.0" | - |
Affected
| ||||||