CVE-2020-11651
highPriorität · handeln · 90OT-Risiko · kritischKEV · ausgenutztEPSS 0.966 · 100. PerzentilExploit · waffenfähigDEEURUUShinzugefügt 2021-11-03beheben bis 2022-05-03
erforderliche Maßnahme Apply updates per vendor instructions.
EPSS · bewertet 2026-10-27
SaltStack Salt Authentication Bypass Vulnerability
An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class does not properly validate method calls. This allows a remote user to access some methods without authentication. These methods can be used to retrieve user tokens from the salt master and/or run arbitrary commands on salt minions.
Behebungen
Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.
Ein Hersteller-Fix ist verfügbar.
- BehobenCisco Modeling Labscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - BehobenCisco TelePresence IX5000 cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - BehobenCisco Virtual Internet Routing Lab cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - WorkaroundCisco Modeling Labscisco_csaf
Cisco CML and Cisco VIRL-PE Cisco CML and Cisco VIRL-PE software releases 2.0 and later do not run the salt-master service. For Cisco CML and Cisco VIRL-PE deployed in standalone mode, administrators can check the status of the salt-master service and disable the service as shown in the following example: virl@virl:~$ sudo systemctl status salt-master ? salt-master.service - The Salt Master Server Loaded: loaded (/lib/systemd/system/salt-master.service; disabled; vendor preset: enabled) Drop-In: /etc/systemd/system/salt-master.service.d +-override.conf Active: active (running) since Thu 2020-05-28 17:55:10 GMT; 1s ago Docs: man:salt-master(1) file:///usr/share/doc/salt/html/contents.html https://docs.saltstack.com/en/latest/contents.html --- Output Omitted --- virl@virl:~$ sudo systemctl stop salt-master virl@virl:~$ sudo systemctl disable salt-master Synchronizing state of salt-master.service with SysV init with /lib/systemd/systemd-sysv-install... Executing /lib/systemd/systemd-sysv-install disable salt-master insserv: warning: current start runlevel(s) (empty) of script `salt-master' overrides LSB defaults (2 3 4 5). insserv: warning: current stop runlevel(s) (0 1 2 3 4 5 6) of script `salt-master' overrides LSB defaults (0 1 6). virl@virl:~$ For Cisco CML and Cisco VIRL-PE deployed in cluster mode, administrators can check the status of the salt-master service and disable the service on all compute nodes. Follow the steps shown above for standalone deployments. On the cluster controller node, ensure that the salt-master is listening only on the private network interface for inter-cluster communication, as shown in the following example: virl@virl:~$ netstat -tulpn | grep 450 (Not all processes could be identified, non-owned process info will not be shown, you would have to be root to see it all.) tcp 0 0 172.16.10.250:4505 0.0.0.0:* LISTEN - tcp 0 0 172.16.10.250:4506 0.0.0.0:* LISTEN - virl@virl:~$ If the salt-master is listening on all interfaces as shown in the following example, customers will need to upgrade to a patched release: virl@virl:~$ netstat -tulpn | grep 450 (Not all processes could be identified, non-owned process info will not be shown, you would have to be root to see it all.) tcp 0 0 0.0.0.0:4505 0.0.0.0:* LISTEN - tcp 0 0 0.0.0.0:4506 0.0.0.0:* LISTEN - virl@virl:~$ Cisco TelePresence IX5000 Series To disable Salt services permanently on Cisco TelePresence IX5000 Series, modifications must be made to the startup script files, which requires root access on the device. For assistance, contact the Cisco TAC through your support organization.
- WorkaroundCisco TelePresence IX5000 cisco_csaf
Cisco CML and Cisco VIRL-PE Cisco CML and Cisco VIRL-PE software releases 2.0 and later do not run the salt-master service. For Cisco CML and Cisco VIRL-PE deployed in standalone mode, administrators can check the status of the salt-master service and disable the service as shown in the following example: virl@virl:~$ sudo systemctl status salt-master ? salt-master.service - The Salt Master Server Loaded: loaded (/lib/systemd/system/salt-master.service; disabled; vendor preset: enabled) Drop-In: /etc/systemd/system/salt-master.service.d +-override.conf Active: active (running) since Thu 2020-05-28 17:55:10 GMT; 1s ago Docs: man:salt-master(1) file:///usr/share/doc/salt/html/contents.html https://docs.saltstack.com/en/latest/contents.html --- Output Omitted --- virl@virl:~$ sudo systemctl stop salt-master virl@virl:~$ sudo systemctl disable salt-master Synchronizing state of salt-master.service with SysV init with /lib/systemd/systemd-sysv-install... Executing /lib/systemd/systemd-sysv-install disable salt-master insserv: warning: current start runlevel(s) (empty) of script `salt-master' overrides LSB defaults (2 3 4 5). insserv: warning: current stop runlevel(s) (0 1 2 3 4 5 6) of script `salt-master' overrides LSB defaults (0 1 6). virl@virl:~$ For Cisco CML and Cisco VIRL-PE deployed in cluster mode, administrators can check the status of the salt-master service and disable the service on all compute nodes. Follow the steps shown above for standalone deployments. On the cluster controller node, ensure that the salt-master is listening only on the private network interface for inter-cluster communication, as shown in the following example: virl@virl:~$ netstat -tulpn | grep 450 (Not all processes could be identified, non-owned process info will not be shown, you would have to be root to see it all.) tcp 0 0 172.16.10.250:4505 0.0.0.0:* LISTEN - tcp 0 0 172.16.10.250:4506 0.0.0.0:* LISTEN - virl@virl:~$ If the salt-master is listening on all interfaces as shown in the following example, customers will need to upgrade to a patched release: virl@virl:~$ netstat -tulpn | grep 450 (Not all processes could be identified, non-owned process info will not be shown, you would have to be root to see it all.) tcp 0 0 0.0.0.0:4505 0.0.0.0:* LISTEN - tcp 0 0 0.0.0.0:4506 0.0.0.0:* LISTEN - virl@virl:~$ Cisco TelePresence IX5000 Series To disable Salt services permanently on Cisco TelePresence IX5000 Series, modifications must be made to the startup script files, which requires root access on the device. For assistance, contact the Cisco TAC through your support organization.
- WorkaroundCisco Virtual Internet Routing Lab cisco_csaf
Cisco CML and Cisco VIRL-PE Cisco CML and Cisco VIRL-PE software releases 2.0 and later do not run the salt-master service. For Cisco CML and Cisco VIRL-PE deployed in standalone mode, administrators can check the status of the salt-master service and disable the service as shown in the following example: virl@virl:~$ sudo systemctl status salt-master ? salt-master.service - The Salt Master Server Loaded: loaded (/lib/systemd/system/salt-master.service; disabled; vendor preset: enabled) Drop-In: /etc/systemd/system/salt-master.service.d +-override.conf Active: active (running) since Thu 2020-05-28 17:55:10 GMT; 1s ago Docs: man:salt-master(1) file:///usr/share/doc/salt/html/contents.html https://docs.saltstack.com/en/latest/contents.html --- Output Omitted --- virl@virl:~$ sudo systemctl stop salt-master virl@virl:~$ sudo systemctl disable salt-master Synchronizing state of salt-master.service with SysV init with /lib/systemd/systemd-sysv-install... Executing /lib/systemd/systemd-sysv-install disable salt-master insserv: warning: current start runlevel(s) (empty) of script `salt-master' overrides LSB defaults (2 3 4 5). insserv: warning: current stop runlevel(s) (0 1 2 3 4 5 6) of script `salt-master' overrides LSB defaults (0 1 6). virl@virl:~$ For Cisco CML and Cisco VIRL-PE deployed in cluster mode, administrators can check the status of the salt-master service and disable the service on all compute nodes. Follow the steps shown above for standalone deployments. On the cluster controller node, ensure that the salt-master is listening only on the private network interface for inter-cluster communication, as shown in the following example: virl@virl:~$ netstat -tulpn | grep 450 (Not all processes could be identified, non-owned process info will not be shown, you would have to be root to see it all.) tcp 0 0 172.16.10.250:4505 0.0.0.0:* LISTEN - tcp 0 0 172.16.10.250:4506 0.0.0.0:* LISTEN - virl@virl:~$ If the salt-master is listening on all interfaces as shown in the following example, customers will need to upgrade to a patched release: virl@virl:~$ netstat -tulpn | grep 450 (Not all processes could be identified, non-owned process info will not be shown, you would have to be root to see it all.) tcp 0 0 0.0.0.0:4505 0.0.0.0:* LISTEN - tcp 0 0 0.0.0.0:4506 0.0.0.0:* LISTEN - virl@virl:~$ Cisco TelePresence IX5000 Series To disable Salt services permanently on Cisco TelePresence IX5000 Series, modifications must be made to the startup script files, which requires root access on the device. For assistance, contact the Cisco TAC through your support organization.
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · high–critical · 7.5–10
SSVC
Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
Exploits (18)
Öffentlicher Proof-of-Concept- und Exploit-Code.
- exploit/linux/misc/saltstack_salt_unauth_rceSaltStack Salt Master/Minion Unauthenticated RCEwaffenfähig · metasploit
- auxiliary/gather/saltstack_salt_root_keySaltStack Salt Master Server Root Key Disclosurefunktional · metasploit
- EDB-48421Saltstack 3000.1 - Remote Code ExecutionPoC · exploit_db
- 0xc0d/CVE-2020-11651CVE-2020-11651: Proof of ConceptPoC · poc_in_github
betroffene Produkte (29)
Betroffene Produkte und Versionsbereiche.
- BlackBerry BlackBerry Workspaces Serveralle Versionencert_bundDEcpe:/h:rim:blackberry:::workspaces_server
Advisories (4)
Hersteller- und Ökosystem-Meldungen dazu.
- WID-SEC-W-2024-1449SaltStack Salt: Mehrere Schwachstellen ermöglichen Erlangen von AdministratorrechtenDeutsch2020-05-04csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in SaltStack Salt ausnutzen, um Administratorrechte zu erlangen.
- cisco-sa-salt-2vx545AGSaltStack FrameWork Vulnerabilities Affecting Cisco Products2020-05-28csaf · cisco_csafUS
On April 29, 2020, the Salt Open Core team notified their community regarding the following two CVE-IDs: CVE-2020-11651: Authentication Bypass Vulnerability CVE-2020-11652: Directory Traversal Vulnerability Cisco Modeling Labs Corporate Edition (CML), Cisco TelePresence IX5000 Series, and Cisco Virtual Internet Routing Lab Personal Edition (VIRL-PE) incorporate a version of SaltStack that is running the salt-master service that is affected by these vulnerabilities. Cisco has released software updates that address these vulnerabilities. There are workarounds that address these vulnerabilities.
- GHSA-pjhf-vpx3-33r3SaltStack Salt Unauthenticated Remote Code Execution2022-05-24ghsa · osvUS
An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class does not properly validate method calls. This allows a remote user to access some methods without authentication. These methods can be used to retrieve user tokens from the salt master and/or run arbitrary commands on salt minions.
- PYSEC-2020-1022020-04-30vendor · osvUS
An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class does not properly validate method calls. This allows a remote user to access some methods without authentication. These methods can be used to retrieve user tokens from the salt master and/or run arbitrary commands on salt minions.
auch bekannt als (7)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (53)
Externe Belege — Patches, Meldungen, Analysen.
- http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00047.htmlcnnvd
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00070.htmlcnnvd
- http://www.nsfocus.net/vulndb/46581cnnvd
- https://cxsecurity.com/issue/WLB-2020050064cnnvd
- https://docs.saltstack.com/en/latest/topics/releases/2019.2.4.htmlcnnvd
- https://github.com/saltstack/salt/blob/v3000.2_docs/doc/topics/releases/3000.2.rstcnnvd
- https://lists.debian.org/debian-lts-announce/2020/05/msg00027.htmlcnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2020-11651cnnvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan