CVE-2020-35662
📋 TL;DR
This vulnerability in SaltStack Salt allows man-in-the-middle attacks by failing to properly validate SSL certificates during authentication to certain services. Attackers can intercept and manipulate communications between Salt master and minions. Organizations using Salt for configuration management before version 3002.5 are affected.
💻 Affected Systems
- SaltStack Salt
📦 What is this software?
Fedora by Fedoraproject
Fedora by Fedoraproject
Fedora by Fedoraproject
Salt by Saltstack
Salt by Saltstack
Salt by Saltstack
Salt by Saltstack
Salt by Saltstack
Salt by Saltstack
Salt by Saltstack
Salt by Saltstack
Salt by Saltstack
Salt by Saltstack
Salt by Saltstack
Salt by Saltstack
Salt by Saltstack
Salt by Saltstack
Salt by Saltstack
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of Salt infrastructure allowing attackers to execute arbitrary commands on all managed systems, steal credentials, and pivot to internal networks.
Likely Case
Credential theft and unauthorized access to Salt-managed systems, potentially leading to configuration manipulation and data exfiltration.
If Mitigated
Limited impact if network segmentation prevents man-in-the-middle positioning and certificate validation is enforced elsewhere.
🎯 Exploit Status
Requires man-in-the-middle position but trivial to exploit once positioned. No public exploit code but technique is well-known.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3002.5 or later
Vendor Advisory: https://saltproject.io/security_announcements/active-saltstack-cve-release-2021-feb-25/
Restart Required: Yes
Instructions:
1. Backup Salt configuration and data. 2. Update Salt using package manager: 'yum update salt' or 'apt-get install salt'. 3. Verify version is 3002.5+. 4. Restart Salt services: 'systemctl restart salt-master salt-minion'. 5. Test functionality.
🔧 Temporary Workarounds
Enforce SSL certificate validation
allConfigure Salt to always validate SSL certificates in vulnerable modules
salt '*' config.set ssl_verify true
salt '*' config.set verify_ssl true
Network segmentation
allIsolate Salt communications to prevent man-in-the-middle attacks
🧯 If You Can't Patch
- Implement strict network controls to prevent man-in-the-middle positioning between Salt components
- Monitor Salt communications for unexpected certificate changes or authentication anomalies
🔍 How to Verify
Check if Vulnerable:
Check Salt version: 'salt --version' or 'salt-master --version'. If version is below 3002.5, system is vulnerable.Check Version:
salt --versionVerify Fix Applied:
Verify version is 3002.5 or higher and test SSL validation with: 'salt-call config.get ssl_verify' should return True.📡 Detection & Monitoring
Log Indicators:
- SSL certificate validation errors in Salt logs
- Unexpected authentication failures
- Changes to SSL/TLS configuration
Network Indicators:
- Unencrypted Salt communications
- SSL/TLS handshake anomalies
- Unexpected intermediate certificates
SIEM Query:
source="salt*" AND ("SSL" OR "certificate" OR "validation") AND ("error" OR "fail" OR "warning")🔗 References
- https://lists.debian.org/debian-lts-announce/2021/11/msg00009.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7GRVZ5WAEI3XFN2BDTL6DDXFS5HYSDVB/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FUGLOJ6NXLCIFRD2JTXBYQEMAEF2B6XH/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YOGNT2XWPOYV7YT75DN7PS4GIYWFKOK5/
- https://saltproject.io/security_announcements/active-saltstack-cve-release-2021-feb-25/
- https://security.gentoo.org/glsa/202103-01
- https://security.gentoo.org/glsa/202310-22
- https://www.debian.org/security/2021/dsa-5011
- https://lists.debian.org/debian-lts-announce/2021/11/msg00009.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7GRVZ5WAEI3XFN2BDTL6DDXFS5HYSDVB/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FUGLOJ6NXLCIFRD2JTXBYQEMAEF2B6XH/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YOGNT2XWPOYV7YT75DN7PS4GIYWFKOK5/
- https://saltproject.io/security_announcements/active-saltstack-cve-release-2021-feb-25/
- https://security.gentoo.org/glsa/202103-01
- https://security.gentoo.org/glsa/202310-22
- https://www.debian.org/security/2021/dsa-5011
