CVE-2021-3144
📋 TL;DR
This vulnerability in SaltStack Salt allows expired eauth tokens to be reused once after expiration, potentially enabling attackers to execute unauthorized commands against the salt master or minions. It affects all SaltStack Salt deployments before version 3002.5. Organizations using vulnerable versions for infrastructure automation are at risk.
💻 Affected Systems
- SaltStack Salt
📦 What is this software?
Fedora by Fedoraproject
Fedora by Fedoraproject
Fedora by Fedoraproject
Salt by Saltstack
Salt by Saltstack
Salt by Saltstack
Salt by Saltstack
Salt by Saltstack
Salt by Saltstack
Salt by Saltstack
Salt by Saltstack
Salt by Saltstack
Salt by Saltstack
Salt by Saltstack
Salt by Saltstack
Salt by Saltstack
Salt by Saltstack
Salt by Saltstack
⚠️ Risk & Real-World Impact
Worst Case
Attackers could gain full administrative control over Salt infrastructure, execute arbitrary commands on all managed systems, steal sensitive data, or deploy ransomware across the entire environment.
Likely Case
Privileged attackers with access to expired tokens could execute unauthorized commands on salt masters or minions, potentially compromising specific systems or services.
If Mitigated
With proper network segmentation and access controls, impact would be limited to isolated segments, though token reuse could still enable some unauthorized actions.
🎯 Exploit Status
Exploitation requires access to expired eauth tokens, which authenticated users could potentially obtain through normal operations.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3002.5 or later
Vendor Advisory: https://github.com/saltstack/salt/releases
Restart Required: Yes
Instructions:
1. Backup configuration and data. 2. Update Salt to version 3002.5 or later using your package manager. 3. Restart salt-master and salt-minion services. 4. Verify the update was successful.
🔧 Temporary Workarounds
Token Expiration Reduction
allReduce eauth token expiration time to minimize window for token reuse
Set 'token_expire' to a lower value in /etc/salt/master configuration
Network Segmentation
allRestrict access to salt master API endpoints
Configure firewall rules to limit access to salt master ports (default 4505-4506)
🧯 If You Can't Patch
- Implement strict network segmentation to isolate salt infrastructure
- Monitor and audit all salt API access and token usage patterns
🔍 How to Verify
Check if Vulnerable:
Check Salt version with 'salt --version' or 'salt-master --version' and verify it's below 3002.5Check Version:
salt --versionVerify Fix Applied:
Confirm version is 3002.5 or higher and test that expired tokens cannot be reused📡 Detection & Monitoring
Log Indicators:
- Multiple authentication attempts with same token ID
- Commands executed with recently expired tokens
- Unusual salt API access patterns
Network Indicators:
- Repeated connections to salt master API with same authentication tokens
- Unusual command execution patterns
SIEM Query:
source="salt-master" AND ("eauth token" OR "authentication") AND ("expired" OR "reuse")🔗 References
- https://github.com/saltstack/salt/releases
- https://lists.debian.org/debian-lts-announce/2021/11/msg00009.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7GRVZ5WAEI3XFN2BDTL6DDXFS5HYSDVB/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FUGLOJ6NXLCIFRD2JTXBYQEMAEF2B6XH/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YOGNT2XWPOYV7YT75DN7PS4GIYWFKOK5/
- https://saltproject.io/security_announcements/active-saltstack-cve-release-2021-feb-25/
- https://security.gentoo.org/glsa/202103-01
- https://security.gentoo.org/glsa/202310-22
- https://www.debian.org/security/2021/dsa-5011
- https://github.com/saltstack/salt/releases
- https://lists.debian.org/debian-lts-announce/2021/11/msg00009.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7GRVZ5WAEI3XFN2BDTL6DDXFS5HYSDVB/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FUGLOJ6NXLCIFRD2JTXBYQEMAEF2B6XH/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YOGNT2XWPOYV7YT75DN7PS4GIYWFKOK5/
- https://saltproject.io/security_announcements/active-saltstack-cve-release-2021-feb-25/
- https://security.gentoo.org/glsa/202103-01
- https://security.gentoo.org/glsa/202310-22
- https://www.debian.org/security/2021/dsa-5011
