SaltStack <=3002 - Shell Injection

Exploited in the wild. Listed by CISA on 2021-11-03; known to be used by ransomware.

criticalseverity

9.8CVSS score

99.6%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

SaltStack Salt through 3002 allows an unauthenticated user with network access to the Salt API to use shell injections to run code on the Salt-API using the SSH client.

Impact

Unauthenticated attackers can execute arbitrary shell commands via the Salt API, leading to complete server compromise and access to all managed systems.

Fix

Upgrade to a patched version of SaltStack (>=3003) to mitigate this vulnerability.

How to confirm it

Send: POST {{BaseURL}}/run
Positive when: regex("CherryPy\/([0-9.]+)", header) || regex("CherryPy ([0-9.]+)", body) AND contains "An unexpected error occurred" AND contains in header "application/json" AND status 500

Run it with nuclei: nuclei -id CVE-2020-16846 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2020-16846

info:
  name: SaltStack <=3002 - Shell Injection
  author: dwisiswant0
  severity: critical
  description: |
    SaltStack Salt through 3002 allows an unauthenticated user with network access to the Salt API to use shell injections to run code on the Salt-API using the SSH client.
  impact: |
    Unauthenticated attackers can execute arbitrary shell commands via the Salt API, leading to complete server compromise and access to all managed systems.
  remediation: |
    Upgrade to a patched version of SaltStack (>=3003) to mitigate this vulnerability.
  reference:
    - https://saltproject.io/on-november-3-2020-saltstack-publicly-disclosed-three-new-cves/
    - https://mp.weixin.qq.com/s/R8qw_lWizGyeJS0jOcYXag
    - https://github.com/vulhub/vulhub/tree/master/saltstack/CVE-2020-16846
    - https://nvd.nist.gov/vuln/detail/CVE-2020-16846
    - http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00029.html
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2020-16846
    cwe-id: CWE-78
    epss-score: 0.99585
    epss-percentile: 0.99946
    cpe: cpe:2.3:a:saltstack:salt:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: saltstack
    product: salt
  tags: cve2020,cve,vulhub,saltstack,kev,vkev,vuln
variables:
  priv: "{{to_lower(rand_text_alpha(5))}}"
  roaster: "{{to_lower(rand_text_alpha(6))}}"

http:
  - method: POST
    path:
      - "{{BaseURL}}/run"

    body: "token=1337&client=ssh&tgt=*&fun=a&roster={{roaster}}&ssh_priv={{priv}}"

    headers:
      Content-Type: application/x-www-form-urlencoded # CherryPy will abort w/o define this header

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - regex("CherryPy\/([0-9.]+)", header) || regex("CherryPy ([0-9.]+)", body)

      - type: word
        part: body
        words:
          - "An unexpected error occurred"

      - type: word
        part: header
        words:
          - "application/json"

      - type: status
        status:
          - 500

References

Use this check only on systems you are authorised to test. Where the data comes from