CVE-2020-28243
📋 TL;DR
CVE-2020-28243 is a command injection vulnerability in SaltStack Salt's restartcheck feature that allows local privilege escalation. Any user who can create files in non-blacklisted directories on a Salt minion can execute arbitrary commands with root privileges. This affects Salt minions running vulnerable versions.
💻 Affected Systems
- SaltStack Salt
📦 What is this software?
Fedora by Fedoraproject
Fedora by Fedoraproject
Fedora by Fedoraproject
Salt by Saltstack
Salt by Saltstack
Salt by Saltstack
Salt by Saltstack
Salt by Saltstack
Salt by Saltstack
Salt by Saltstack
Salt by Saltstack
Salt by Saltstack
Salt by Saltstack
Salt by Saltstack
Salt by Saltstack
Salt by Saltstack
Salt by Saltstack
Salt by Saltstack
⚠️ Risk & Real-World Impact
Worst Case
Full root compromise of the Salt minion system, allowing attacker to install persistent backdoors, steal credentials, pivot to other systems, and disrupt infrastructure operations.
Likely Case
Local privilege escalation to root on affected minions, enabling attackers to modify system configurations, access sensitive data, and potentially compromise the Salt master through minion trust relationships.
If Mitigated
Limited impact if proper file permissions restrict non-privileged users from creating files in vulnerable directories and SaltStack is properly segmented.
🎯 Exploit Status
Exploit requires local user access to minion. Public proof-of-concept available on GitHub. Attackers need ability to create files in specific directories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3002.5 and later
Vendor Advisory: https://docs.saltproject.io/en/latest/topics/releases/3002.5.html
Restart Required: Yes
Instructions:
1. Update Salt minion to version 3002.5 or later using package manager. 2. For Debian/Ubuntu: 'sudo apt update && sudo apt install salt-minion'. 3. For RHEL/CentOS: 'sudo yum update salt-minion'. 4. Restart salt-minion service: 'sudo systemctl restart salt-minion'.
🔧 Temporary Workarounds
Restrict file creation permissions
linuxLimit non-privileged users' ability to create files in directories accessible to restartcheck
sudo chmod 750 /var/run/salt/minion
sudo chown root:salt /var/run/salt/minion
Disable restartcheck feature
linuxTemporarily disable the vulnerable restartcheck functionality
sudo salt-call config.set restartcheck False
sudo systemctl restart salt-minion
🧯 If You Can't Patch
- Implement strict file permissions to prevent non-root users from creating files in Salt-related directories
- Monitor for suspicious process creation and file system activity on Salt minions using auditd or similar tools
🔍 How to Verify
Check if Vulnerable:
Check Salt version: 'salt-minion --version' or 'dpkg -l | grep salt-minion' or 'rpm -qa | grep salt-minion'. If version is below 3002.5, system is vulnerable.Check Version:
salt-minion --versionVerify Fix Applied:
Confirm version is 3002.5 or higher: 'salt-minion --version | grep -q '3002\.5\|3003' && echo 'Patched' || echo 'Vulnerable'📡 Detection & Monitoring
Log Indicators:
- Unusual process execution from salt-minion user
- Suspicious commands in /var/log/salt/minion logs
- Failed restartcheck operations with unusual parameters
Network Indicators:
- Unusual outbound connections from minion systems
- Anomalous salt master-minion communication patterns
SIEM Query:
process.name:salt-minion AND (process.cmdline:*restartcheck* OR process.cmdline:*sh* OR process.cmdline:*bash*)🔗 References
- https://github.com/stealthcopter/CVE-2020-28243
- https://lists.debian.org/debian-lts-announce/2021/11/msg00009.html
- https://lists.debian.org/debian-lts-announce/2022/01/msg00000.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7GRVZ5WAEI3XFN2BDTL6DDXFS5HYSDVB/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FUGLOJ6NXLCIFRD2JTXBYQEMAEF2B6XH/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YOGNT2XWPOYV7YT75DN7PS4GIYWFKOK5/
- https://saltproject.io/security_announcements/active-saltstack-cve-release-2021-feb-25/
- https://sec.stealthcopter.com/cve-2020-28243/
- https://security.gentoo.org/glsa/202103-01
- https://security.gentoo.org/glsa/202310-22
- https://www.debian.org/security/2021/dsa-5011
- https://github.com/stealthcopter/CVE-2020-28243
- https://lists.debian.org/debian-lts-announce/2021/11/msg00009.html
- https://lists.debian.org/debian-lts-announce/2022/01/msg00000.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7GRVZ5WAEI3XFN2BDTL6DDXFS5HYSDVB/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FUGLOJ6NXLCIFRD2JTXBYQEMAEF2B6XH/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YOGNT2XWPOYV7YT75DN7PS4GIYWFKOK5/
- https://saltproject.io/security_announcements/active-saltstack-cve-release-2021-feb-25/
- https://sec.stealthcopter.com/cve-2020-28243/
- https://security.gentoo.org/glsa/202103-01
- https://security.gentoo.org/glsa/202310-22
- https://www.debian.org/security/2021/dsa-5011
