// For flags

CVE-2023-34049

Salt security advisory release - 2023-OCT-27

Severity Score

6.7
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Track*
*SSVC
Descriptions

The Salt-SSH pre-flight option copies the script to the target at a predictable path, which allows an attacker to force Salt-SSH to run their script. If an attacker has access to the target VM and knows the path to the pre-flight script before it runs they can ensure Salt-SSH runs their script with the privileges of the user running Salt-SSH. Do not make the copy path on the target predictable and ensure we check return codes of the scp command if the copy fails.

The Salt-SSH pre-flight option copies the script to the target at a predictable path, which allows an attacker to force Salt-SSH to run their script. If an attacker has access to the target VM and knows the path to the pre-flight script before it runs they can ensure Salt-SSH runs their script with the privileges of the user running Salt-SSH. Do not make the copy path on the target predictable and ensure we check return codes of the scp command if the copy fails.

Gentoo Linux Security Advisory 202412-9 - Multiple vulnerabilities have been discovered in Salt, the worst of which can lead to arbitrary code execution. Versions greater than or equal to 3006.6 are affected.

*Credits: N/A
CVSS Scores
Attack Vector
Local
Attack Complexity
High
Privileges Required
Low
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Local
Attack Complexity
Low
Authentication
None
Confidentiality
Complete
Integrity
Complete
Availability
Complete
* Common Vulnerability Scoring System
SSVC
  • Decision:Track*
Exploitation
None
Automatable
No
Tech. Impact
Total
* Organization's Worst-case Scenario
Timeline
  • 2023-05-25 CVE Reserved
  • 2024-11-14 CVE Published
  • 2024-11-14 CVE Updated
  • 2024-11-14 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Fedoraproject
Search vendor "Fedoraproject"
Fedora
Search vendor "Fedoraproject" for product "Fedora"
*-
Affected
Opensuse
Search vendor "Opensuse"
Leap
Search vendor "Opensuse" for product "Leap"
*-
Affected
Suse
Search vendor "Suse"
Sle-module-basesystem
Search vendor "Suse" for product "Sle-module-basesystem"
*-
Affected
Suse
Search vendor "Suse"
Sle-module-server-applications
Search vendor "Suse" for product "Sle-module-server-applications"
*-
Affected
Suse
Search vendor "Suse"
Sle-module-suse-manager-proxy
Search vendor "Suse" for product "Sle-module-suse-manager-proxy"
*-
Affected
Suse
Search vendor "Suse"
Sle-module-suse-manager-server
Search vendor "Suse" for product "Sle-module-suse-manager-server"
*-
Affected
Suse
Search vendor "Suse"
Sle-module-transactional-server
Search vendor "Suse" for product "Sle-module-transactional-server"
*-
Affected
Suse
Search vendor "Suse"
Sle Hpc-espos
Search vendor "Suse" for product "Sle Hpc-espos"
*-
Affected
Suse
Search vendor "Suse"
Sle Hpc-ltss
Search vendor "Suse" for product "Sle Hpc-ltss"
*-
Affected
Suse
Search vendor "Suse"
Sle Hpc
Search vendor "Suse" for product "Sle Hpc"
*-
Affected
Suse
Search vendor "Suse"
Sled
Search vendor "Suse" for product "Sled"
*-
Affected
Suse
Search vendor "Suse"
Sles-ltss
Search vendor "Suse" for product "Sles-ltss"
*-
Affected
Suse
Search vendor "Suse"
Sles
Search vendor "Suse" for product "Sles"
*-
Affected
Suse
Search vendor "Suse"
Sles Sap
Search vendor "Suse" for product "Sles Sap"
*-
Affected
Suse
Search vendor "Suse"
Suse-manager-proxy
Search vendor "Suse" for product "Suse-manager-proxy"
*-
Affected
Suse
Search vendor "Suse"
Suse-manager-retail-branch-server
Search vendor "Suse" for product "Suse-manager-retail-branch-server"
*-
Affected
Suse
Search vendor "Suse"
Suse-manager-server
Search vendor "Suse" for product "Suse-manager-server"
*-
Affected