CVE-2021-25283
📋 TL;DR
This vulnerability allows server-side template injection (SSTI) in SaltStack Salt's Jinja renderer, enabling attackers to execute arbitrary code on Salt masters. It affects all SaltStack Salt deployments before version 3002.5. The high CVSS score of 9.8 reflects the potential for complete system compromise.
💻 Affected Systems
- SaltStack Salt
📦 What is this software?
Fedora by Fedoraproject
Fedora by Fedoraproject
Fedora by Fedoraproject
Salt by Saltstack
Salt by Saltstack
Salt by Saltstack
Salt by Saltstack
Salt by Saltstack
Salt by Saltstack
Salt by Saltstack
Salt by Saltstack
Salt by Saltstack
Salt by Saltstack
Salt by Saltstack
Salt by Saltstack
Salt by Saltstack
Salt by Saltstack
Salt by Saltstack
⚠️ Risk & Real-World Impact
Worst Case
Full remote code execution on Salt master leading to complete system takeover, data exfiltration, lateral movement across infrastructure, and persistent backdoor installation.
Likely Case
Unauthenticated attackers exploiting internet-facing Salt masters to execute arbitrary commands, potentially gaining control over managed minions and sensitive configuration data.
If Mitigated
Limited impact if Salt masters are properly segmented, access is restricted, and network controls prevent external exploitation attempts.
🎯 Exploit Status
Exploitation is straightforward once the vulnerability is understood. Multiple proof-of-concept examples exist in security communities.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3002.5 or later
Vendor Advisory: https://github.com/saltstack/salt/releases
Restart Required: Yes
Instructions:
1. Backup Salt configuration and data. 2. Upgrade to Salt version 3002.5 or later using package manager (yum/apt). 3. Restart Salt master service. 4. Verify all minions reconnect properly.
🔧 Temporary Workarounds
Network Segmentation
linuxRestrict access to Salt master API ports (default 4505-4506) to trusted networks only
iptables -A INPUT -p tcp --dport 4505:4506 -s TRUSTED_NETWORK -j ACCEPT
iptables -A INPUT -p tcp --dport 4505:4506 -j DROP
Disable External API Access
allConfigure Salt master to only listen on localhost or internal interfaces
Edit /etc/salt/master: set 'interface: 127.0.0.1' or 'interface: INTERNAL_IP'
🧯 If You Can't Patch
- Implement strict network access controls to Salt master ports (4505-4506)
- Monitor for suspicious template rendering patterns and Salt API access logs
🔍 How to Verify
Check if Vulnerable:
Check Salt version: salt --version or salt-master --version. If version is below 3002.5, system is vulnerable.Check Version:
salt --versionVerify Fix Applied:
After upgrade, verify version is 3002.5 or higher and test template rendering functionality works normally.📡 Detection & Monitoring
Log Indicators:
- Unusual template rendering patterns in Salt master logs
- Unexpected commands executed via Salt API
- Access to Salt API from unauthorized IP addresses
Network Indicators:
- Unusual traffic to Salt master ports (4505-4506) from external sources
- Large template payloads in network traffic
SIEM Query:
source="salt-master.log" AND ("template injection" OR "jinja render" OR "SSTI")🔗 References
- https://github.com/saltstack/salt/releases
- https://lists.debian.org/debian-lts-announce/2021/11/msg00009.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7GRVZ5WAEI3XFN2BDTL6DDXFS5HYSDVB/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FUGLOJ6NXLCIFRD2JTXBYQEMAEF2B6XH/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YOGNT2XWPOYV7YT75DN7PS4GIYWFKOK5/
- https://saltproject.io/security_announcements/active-saltstack-cve-release-2021-feb-25/
- https://security.gentoo.org/glsa/202103-01
- https://security.gentoo.org/glsa/202310-22
- https://www.debian.org/security/2021/dsa-5011
- https://github.com/saltstack/salt/releases
- https://lists.debian.org/debian-lts-announce/2021/11/msg00009.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7GRVZ5WAEI3XFN2BDTL6DDXFS5HYSDVB/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FUGLOJ6NXLCIFRD2JTXBYQEMAEF2B6XH/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YOGNT2XWPOYV7YT75DN7PS4GIYWFKOK5/
- https://saltproject.io/security_announcements/active-saltstack-cve-release-2021-feb-25/
- https://security.gentoo.org/glsa/202103-01
- https://security.gentoo.org/glsa/202310-22
- https://www.debian.org/security/2021/dsa-5011
