CVE-2021-25281
📋 TL;DR
This vulnerability in SaltStack Salt allows unauthenticated remote attackers to execute arbitrary wheel modules on the Salt master via salt-api. The wheel_async client does not properly validate eauth credentials, enabling complete system compromise. All SaltStack deployments with salt-api enabled and running versions before 3002.5 are affected.
💻 Affected Systems
- SaltStack Salt
📦 What is this software?
Fedora by Fedoraproject
Fedora by Fedoraproject
Fedora by Fedoraproject
Salt by Saltstack
Salt by Saltstack
Salt by Saltstack
Salt by Saltstack
Salt by Saltstack
Salt by Saltstack
Salt by Saltstack
Salt by Saltstack
Salt by Saltstack
Salt by Saltstack
Salt by Saltstack
Salt by Saltstack
Salt by Saltstack
Salt by Saltstack
Salt by Saltstack
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the Salt master, allowing attackers to execute arbitrary commands as root, steal sensitive data, deploy malware, and pivot to other systems in the infrastructure.
Likely Case
Remote code execution leading to data theft, system manipulation, and potential lateral movement within the environment.
If Mitigated
Limited impact if proper network segmentation and access controls prevent external access to salt-api endpoints.
🎯 Exploit Status
Public exploit code is available and trivial to use. The vulnerability requires no authentication and minimal technical skill to exploit.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3002.5 and later
Vendor Advisory: https://github.com/saltstack/salt/releases
Restart Required: Yes
Instructions:
1. Upgrade Salt master to version 3002.5 or later. 2. Restart salt-master and salt-api services. 3. Verify the fix by checking version and testing authentication.
🔧 Temporary Workarounds
Disable salt-api
linuxTemporarily disable salt-api service if immediate patching is not possible
systemctl stop salt-api
systemctl disable salt-api
Network access control
linuxRestrict network access to salt-api port (default 8000) using firewall rules
iptables -A INPUT -p tcp --dport 8000 -j DROP
firewall-cmd --permanent --remove-port=8000/tcp
firewall-cmd --reload
🧯 If You Can't Patch
- Immediately disable salt-api service on all masters
- Implement strict network segmentation and firewall rules to block all external access to salt-api endpoints
🔍 How to Verify
Check if Vulnerable:
Check Salt version: if version is below 3002.5 and salt-api is enabled, the system is vulnerable.Check Version:
salt --versions-report | grep -i saltVerify Fix Applied:
Verify Salt version is 3002.5 or higher and test that wheel_async endpoints now require proper authentication.📡 Detection & Monitoring
Log Indicators:
- Unauthenticated requests to /run endpoint in salt-api logs
- Wheel module executions from unexpected sources
- Failed authentication attempts followed by successful wheel operations
Network Indicators:
- Unusual traffic to salt-api port 8000 from unexpected sources
- HTTP POST requests to /run without proper authentication headers
SIEM Query:
source="salt-api" AND (uri_path="/run" OR uri_path="/events") AND (http_status=200 OR http_status=202) AND NOT (auth_token=*)🔗 References
- http://packetstormsecurity.com/files/162058/SaltStack-Salt-API-Unauthenticated-Remote-Command-Execution.html
- https://github.com/saltstack/salt/releases
- https://lists.debian.org/debian-lts-announce/2021/11/msg00009.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7GRVZ5WAEI3XFN2BDTL6DDXFS5HYSDVB/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FUGLOJ6NXLCIFRD2JTXBYQEMAEF2B6XH/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YOGNT2XWPOYV7YT75DN7PS4GIYWFKOK5/
- https://saltproject.io/security_announcements/active-saltstack-cve-release-2021-feb-25/
- https://security.gentoo.org/glsa/202103-01
- https://security.gentoo.org/glsa/202310-22
- https://www.debian.org/security/2021/dsa-5011
- https://www.saltstack.com/blog/active-saltstack-cve-announced-2021-jan-21/
- http://packetstormsecurity.com/files/162058/SaltStack-Salt-API-Unauthenticated-Remote-Command-Execution.html
- https://github.com/saltstack/salt/releases
- https://lists.debian.org/debian-lts-announce/2021/11/msg00009.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7GRVZ5WAEI3XFN2BDTL6DDXFS5HYSDVB/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FUGLOJ6NXLCIFRD2JTXBYQEMAEF2B6XH/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YOGNT2XWPOYV7YT75DN7PS4GIYWFKOK5/
- https://saltproject.io/security_announcements/active-saltstack-cve-release-2021-feb-25/
- https://security.gentoo.org/glsa/202103-01
- https://security.gentoo.org/glsa/202310-22
- https://www.debian.org/security/2021/dsa-5011
- https://www.saltstack.com/blog/active-saltstack-cve-announced-2021-jan-21/
