CVE-2019-1010259
📋 TL;DR
This SQL injection vulnerability in SaltStack Salt allows attackers to execute arbitrary SQL commands through the mysql.user_chpass function. Attackers can escalate privileges on MySQL servers deployed by cloud providers, potentially leading to remote code execution. Organizations using affected SaltStack versions with MySQL modules are at risk.
💻 Affected Systems
- SaltStack Salt
📦 What is this software?
Salt 2018 by Saltstack
Salt 2019 by Saltstack
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of MySQL servers, privilege escalation to root, and remote code execution on underlying systems, potentially affecting entire cloud deployments.
Likely Case
Database compromise, data exfiltration, and lateral movement within the affected infrastructure.
If Mitigated
Limited impact if proper network segmentation, least privilege access, and input validation are implemented.
🎯 Exploit Status
Exploitation requires access to execute Salt commands. The SQL injection is straightforward once an attacker gains initial access to the Salt environment.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2018.3.4, 2019.2.2
Vendor Advisory: https://github.com/saltstack/salt/security/advisories/GHSA-xxxx-xxxx-xxxx
Restart Required: No
Instructions:
1. Update SaltStack to version 2018.3.4 or 2019.2.2 or later. 2. Run: pip install salt==2018.3.4 or pip install salt==2019.2.2. 3. Verify the update with: salt --version.
🔧 Temporary Workarounds
Disable MySQL module
allTemporarily disable the vulnerable MySQL module if not required
salt '*' sys.disable_module mysql
Restrict Salt command execution
allLimit who can execute Salt commands, especially MySQL module functions
Configure Salt's access controls and external auth systems
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Salt masters from MySQL servers
- Apply input validation and parameterized queries at the application layer
🔍 How to Verify
Check if Vulnerable:
Check Salt version: salt --version. If version is between 2018.3-2018.3.3 or 2019.2-2019.2.1, system is vulnerable.Check Version:
salt --versionVerify Fix Applied:
Verify version is 2018.3.4 or 2019.2.2 or later. Test mysql.user_chpass function with controlled inputs.📡 Detection & Monitoring
Log Indicators:
- Unusual mysql.user_chpass function calls
- SQL error messages in Salt logs
- Unexpected privilege changes in MySQL
Network Indicators:
- Unusual database connections from Salt masters
- SQL injection patterns in network traffic
SIEM Query:
source="salt-master" AND "mysql.user_chpass" AND ("SQL" OR "syntax" OR "error")🔗 References
- https://github.com/ShantonRU/salt/commit/a46c86a987c78e74e87969d8d3b27094e6544b7a
- https://github.com/saltstack/salt/blob/f22de0887cd7167887f113bf394244b74fb36b6b/salt/modules/mysql.py#L1534
- https://github.com/saltstack/salt/pull/51462
- https://github.com/ShantonRU/salt/commit/a46c86a987c78e74e87969d8d3b27094e6544b7a
- https://github.com/saltstack/salt/blob/f22de0887cd7167887f113bf394244b74fb36b6b/salt/modules/mysql.py#L1534
- https://github.com/saltstack/salt/pull/51462
