CVE-2020-11651
highpriority · act · 90OT risk · criticalKEV · exploitedEPSS 0.966 · 100 %ileexploit · weaponizedDEEURUUSadded 2021-11-03remediate by 2022-05-03
required action Apply updates per vendor instructions.
EPSS · scored 2026-10-27
SaltStack Salt Authentication Bypass Vulnerability
An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class does not properly validate method calls. This allows a remote user to access some methods without authentication. These methods can be used to retrieve user tokens from the salt master and/or run arbitrary commands on salt minions.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- FixedCisco Modeling Labscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco TelePresence IX5000 cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Virtual Internet Routing Lab cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - WorkaroundCisco Modeling Labscisco_csaf
Cisco CML and Cisco VIRL-PE Cisco CML and Cisco VIRL-PE software releases 2.0 and later do not run the salt-master service. For Cisco CML and Cisco VIRL-PE deployed in standalone mode, administrators can check the status of the salt-master service and disable the service as shown in the following example: virl@virl:~$ sudo systemctl status salt-master ? salt-master.service - The Salt Master Server Loaded: loaded (/lib/systemd/system/salt-master.service; disabled; vendor preset: enabled) Drop-In: /etc/systemd/system/salt-master.service.d +-override.conf Active: active (running) since Thu 2020-05-28 17:55:10 GMT; 1s ago Docs: man:salt-master(1) file:///usr/share/doc/salt/html/contents.html https://docs.saltstack.com/en/latest/contents.html --- Output Omitted --- virl@virl:~$ sudo systemctl stop salt-master virl@virl:~$ sudo systemctl disable salt-master Synchronizing state of salt-master.service with SysV init with /lib/systemd/systemd-sysv-install... Executing /lib/systemd/systemd-sysv-install disable salt-master insserv: warning: current start runlevel(s) (empty) of script `salt-master' overrides LSB defaults (2 3 4 5). insserv: warning: current stop runlevel(s) (0 1 2 3 4 5 6) of script `salt-master' overrides LSB defaults (0 1 6). virl@virl:~$ For Cisco CML and Cisco VIRL-PE deployed in cluster mode, administrators can check the status of the salt-master service and disable the service on all compute nodes. Follow the steps shown above for standalone deployments. On the cluster controller node, ensure that the salt-master is listening only on the private network interface for inter-cluster communication, as shown in the following example: virl@virl:~$ netstat -tulpn | grep 450 (Not all processes could be identified, non-owned process info will not be shown, you would have to be root to see it all.) tcp 0 0 172.16.10.250:4505 0.0.0.0:* LISTEN - tcp 0 0 172.16.10.250:4506 0.0.0.0:* LISTEN - virl@virl:~$ If the salt-master is listening on all interfaces as shown in the following example, customers will need to upgrade to a patched release: virl@virl:~$ netstat -tulpn | grep 450 (Not all processes could be identified, non-owned process info will not be shown, you would have to be root to see it all.) tcp 0 0 0.0.0.0:4505 0.0.0.0:* LISTEN - tcp 0 0 0.0.0.0:4506 0.0.0.0:* LISTEN - virl@virl:~$ Cisco TelePresence IX5000 Series To disable Salt services permanently on Cisco TelePresence IX5000 Series, modifications must be made to the startup script files, which requires root access on the device. For assistance, contact the Cisco TAC through your support organization.
- WorkaroundCisco TelePresence IX5000 cisco_csaf
Cisco CML and Cisco VIRL-PE Cisco CML and Cisco VIRL-PE software releases 2.0 and later do not run the salt-master service. For Cisco CML and Cisco VIRL-PE deployed in standalone mode, administrators can check the status of the salt-master service and disable the service as shown in the following example: virl@virl:~$ sudo systemctl status salt-master ? salt-master.service - The Salt Master Server Loaded: loaded (/lib/systemd/system/salt-master.service; disabled; vendor preset: enabled) Drop-In: /etc/systemd/system/salt-master.service.d +-override.conf Active: active (running) since Thu 2020-05-28 17:55:10 GMT; 1s ago Docs: man:salt-master(1) file:///usr/share/doc/salt/html/contents.html https://docs.saltstack.com/en/latest/contents.html --- Output Omitted --- virl@virl:~$ sudo systemctl stop salt-master virl@virl:~$ sudo systemctl disable salt-master Synchronizing state of salt-master.service with SysV init with /lib/systemd/systemd-sysv-install... Executing /lib/systemd/systemd-sysv-install disable salt-master insserv: warning: current start runlevel(s) (empty) of script `salt-master' overrides LSB defaults (2 3 4 5). insserv: warning: current stop runlevel(s) (0 1 2 3 4 5 6) of script `salt-master' overrides LSB defaults (0 1 6). virl@virl:~$ For Cisco CML and Cisco VIRL-PE deployed in cluster mode, administrators can check the status of the salt-master service and disable the service on all compute nodes. Follow the steps shown above for standalone deployments. On the cluster controller node, ensure that the salt-master is listening only on the private network interface for inter-cluster communication, as shown in the following example: virl@virl:~$ netstat -tulpn | grep 450 (Not all processes could be identified, non-owned process info will not be shown, you would have to be root to see it all.) tcp 0 0 172.16.10.250:4505 0.0.0.0:* LISTEN - tcp 0 0 172.16.10.250:4506 0.0.0.0:* LISTEN - virl@virl:~$ If the salt-master is listening on all interfaces as shown in the following example, customers will need to upgrade to a patched release: virl@virl:~$ netstat -tulpn | grep 450 (Not all processes could be identified, non-owned process info will not be shown, you would have to be root to see it all.) tcp 0 0 0.0.0.0:4505 0.0.0.0:* LISTEN - tcp 0 0 0.0.0.0:4506 0.0.0.0:* LISTEN - virl@virl:~$ Cisco TelePresence IX5000 Series To disable Salt services permanently on Cisco TelePresence IX5000 Series, modifications must be made to the startup script files, which requires root access on the device. For assistance, contact the Cisco TAC through your support organization.
- WorkaroundCisco Virtual Internet Routing Lab cisco_csaf
Cisco CML and Cisco VIRL-PE Cisco CML and Cisco VIRL-PE software releases 2.0 and later do not run the salt-master service. For Cisco CML and Cisco VIRL-PE deployed in standalone mode, administrators can check the status of the salt-master service and disable the service as shown in the following example: virl@virl:~$ sudo systemctl status salt-master ? salt-master.service - The Salt Master Server Loaded: loaded (/lib/systemd/system/salt-master.service; disabled; vendor preset: enabled) Drop-In: /etc/systemd/system/salt-master.service.d +-override.conf Active: active (running) since Thu 2020-05-28 17:55:10 GMT; 1s ago Docs: man:salt-master(1) file:///usr/share/doc/salt/html/contents.html https://docs.saltstack.com/en/latest/contents.html --- Output Omitted --- virl@virl:~$ sudo systemctl stop salt-master virl@virl:~$ sudo systemctl disable salt-master Synchronizing state of salt-master.service with SysV init with /lib/systemd/systemd-sysv-install... Executing /lib/systemd/systemd-sysv-install disable salt-master insserv: warning: current start runlevel(s) (empty) of script `salt-master' overrides LSB defaults (2 3 4 5). insserv: warning: current stop runlevel(s) (0 1 2 3 4 5 6) of script `salt-master' overrides LSB defaults (0 1 6). virl@virl:~$ For Cisco CML and Cisco VIRL-PE deployed in cluster mode, administrators can check the status of the salt-master service and disable the service on all compute nodes. Follow the steps shown above for standalone deployments. On the cluster controller node, ensure that the salt-master is listening only on the private network interface for inter-cluster communication, as shown in the following example: virl@virl:~$ netstat -tulpn | grep 450 (Not all processes could be identified, non-owned process info will not be shown, you would have to be root to see it all.) tcp 0 0 172.16.10.250:4505 0.0.0.0:* LISTEN - tcp 0 0 172.16.10.250:4506 0.0.0.0:* LISTEN - virl@virl:~$ If the salt-master is listening on all interfaces as shown in the following example, customers will need to upgrade to a patched release: virl@virl:~$ netstat -tulpn | grep 450 (Not all processes could be identified, non-owned process info will not be shown, you would have to be root to see it all.) tcp 0 0 0.0.0.0:4505 0.0.0.0:* LISTEN - tcp 0 0 0.0.0.0:4506 0.0.0.0:* LISTEN - virl@virl:~$ Cisco TelePresence IX5000 Series To disable Salt services permanently on Cisco TelePresence IX5000 Series, modifications must be made to the startup script files, which requires root access on the device. For assistance, contact the Cisco TAC through your support organization.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 7.5–10
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
exploits (18)
Public proof-of-concept and weaponised exploit code.
- exploit/linux/misc/saltstack_salt_unauth_rceSaltStack Salt Master/Minion Unauthenticated RCEweaponized · metasploit
- auxiliary/gather/saltstack_salt_root_keySaltStack Salt Master Server Root Key Disclosurefunctional · metasploit
- EDB-48421Saltstack 3000.1 - Remote Code ExecutionPoC · exploit_db
- 0xc0d/CVE-2020-11651CVE-2020-11651: Proof of ConceptPoC · poc_in_github
affected products (29)
Products and version ranges known to be affected.
- BlackBerry BlackBerry Workspaces Serverall versionscert_bundDEcpe:/h:rim:blackberry:::workspaces_server
advisories (4)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2024-1449SaltStack Salt: Mehrere Schwachstellen ermöglichen Erlangen von AdministratorrechtenDeutsch2020-05-04csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in SaltStack Salt ausnutzen, um Administratorrechte zu erlangen.
- cisco-sa-salt-2vx545AGSaltStack FrameWork Vulnerabilities Affecting Cisco Products2020-05-28csaf · cisco_csafUS
On April 29, 2020, the Salt Open Core team notified their community regarding the following two CVE-IDs: CVE-2020-11651: Authentication Bypass Vulnerability CVE-2020-11652: Directory Traversal Vulnerability Cisco Modeling Labs Corporate Edition (CML), Cisco TelePresence IX5000 Series, and Cisco Virtual Internet Routing Lab Personal Edition (VIRL-PE) incorporate a version of SaltStack that is running the salt-master service that is affected by these vulnerabilities. Cisco has released software updates that address these vulnerabilities. There are workarounds that address these vulnerabilities.
- GHSA-pjhf-vpx3-33r3SaltStack Salt Unauthenticated Remote Code Execution2022-05-24ghsa · osvUS
An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class does not properly validate method calls. This allows a remote user to access some methods without authentication. These methods can be used to retrieve user tokens from the salt master and/or run arbitrary commands on salt minions.
- PYSEC-2020-1022020-04-30vendor · osvUS
An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class does not properly validate method calls. This allows a remote user to access some methods without authentication. These methods can be used to retrieve user tokens from the salt master and/or run arbitrary commands on salt minions.
also known as (7)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (53)
External citations — patches, advisories, analysis.
- http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00047.htmlcnnvd
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00070.htmlcnnvd
- http://www.nsfocus.net/vulndb/46581cnnvd
- https://cxsecurity.com/issue/WLB-2020050064cnnvd
- https://docs.saltstack.com/en/latest/topics/releases/2019.2.4.htmlcnnvd
- https://github.com/saltstack/salt/blob/v3000.2_docs/doc/topics/releases/3000.2.rstcnnvd
- https://lists.debian.org/debian-lts-announce/2020/05/msg00027.htmlcnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2020-11651cnnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan