CVE-2020-25592
📋 TL;DR
CVE-2020-25592 is an authentication bypass vulnerability in SaltStack Salt's REST API (salt-netapi) that allows attackers to execute arbitrary commands via Salt SSH without valid credentials. This affects all SaltStack Salt installations with the REST API enabled through version 3002. Organizations using Salt for infrastructure management are at risk of complete system compromise.
💻 Affected Systems
- SaltStack Salt
📦 What is this software?
Salt by Saltstack
Salt by Saltstack
Salt by Saltstack
Salt by Saltstack
Salt by Saltstack
Salt by Saltstack
Salt by Saltstack
Salt by Saltstack
Salt by Saltstack
Salt by Saltstack
Salt by Saltstack
Salt by Saltstack
Salt by Saltstack
Salt by Saltstack
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of Salt-managed infrastructure, allowing attackers to execute arbitrary commands on all minions, steal sensitive data, deploy ransomware, or establish persistent backdoors.
Likely Case
Attackers gain unauthorized access to execute commands on Salt minions, potentially leading to data exfiltration, service disruption, or lateral movement within the network.
If Mitigated
Limited impact if proper network segmentation, authentication controls, and monitoring are in place, though the vulnerability still presents significant risk.
🎯 Exploit Status
Public exploit code available on Packet Storm and other sources. Attack requires network access to the salt-netapi endpoint (default port 8000).
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3002.1 and later versions
Vendor Advisory: https://docs.saltstack.com/en/latest/topics/releases/index.html
Restart Required: Yes
Instructions:
1. Upgrade Salt master to version 3002.1 or later. 2. Restart salt-master service. 3. Verify the fix by checking version and testing authentication.
🔧 Temporary Workarounds
Disable salt-netapi
linuxTemporarily disable the vulnerable REST API component until patching is possible
systemctl stop salt-api
systemctl disable salt-api
Network Access Control
linuxRestrict network access to salt-netapi port (default 8000) using firewall rules
iptables -A INPUT -p tcp --dport 8000 -j DROP
ufw deny 8000
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Salt master from untrusted networks
- Enable detailed logging and monitoring for salt-api authentication attempts and command execution
🔍 How to Verify
Check if Vulnerable:
Check Salt version: if version <= 3002 and salt-api is running, system is vulnerable. Use: salt --versionCheck Version:
salt --versionVerify Fix Applied:
Verify version is 3002.1 or later and test authentication with invalid credentials should fail📡 Detection & Monitoring
Log Indicators:
- Failed authentication attempts followed by successful command execution in /var/log/salt/master
- Unusual SSH connections from Salt master to minions
- Authentication bypass patterns in salt-api logs
Network Indicators:
- Unusual traffic to salt-api port 8000 from unexpected sources
- SSH connections from Salt master to multiple minions in rapid succession
SIEM Query:
source="salt-master" AND (event="auth" AND result="failure") AND (event="cmd.run" OR event="state.apply") within 5 minutes🔗 References
- http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00029.html
- http://packetstormsecurity.com/files/160039/SaltStack-Salt-REST-API-Arbitrary-Command-Execution.html
- https://docs.saltstack.com/en/latest/topics/releases/index.html
- https://lists.debian.org/debian-lts-announce/2020/12/msg00007.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TPOGB2F6XUAIGFDTOCQDNB2VIXFXHWMA/
- https://security.gentoo.org/glsa/202011-13
- https://www.debian.org/security/2021/dsa-4837
- https://www.saltstack.com/blog/on-november-3-2020-saltstack-publicly-disclosed-three-new-cves/
- http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00029.html
- http://packetstormsecurity.com/files/160039/SaltStack-Salt-REST-API-Arbitrary-Command-Execution.html
- https://docs.saltstack.com/en/latest/topics/releases/index.html
- https://lists.debian.org/debian-lts-announce/2020/12/msg00007.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TPOGB2F6XUAIGFDTOCQDNB2VIXFXHWMA/
- https://security.gentoo.org/glsa/202011-13
- https://www.debian.org/security/2021/dsa-4837
- https://www.saltstack.com/blog/on-november-3-2020-saltstack-publicly-disclosed-three-new-cves/
