CVE-2021-3197
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary shell commands on SaltStack Salt servers via shell injection in the salt-api SSH client. Attackers can exploit this by including malicious ProxyCommand arguments or ssh_options in API requests. Systems running SaltStack Salt versions before 3002.5 with salt-api enabled are affected.
💻 Affected Systems
- SaltStack Salt
📦 What is this software?
Fedora by Fedoraproject
Fedora by Fedoraproject
Fedora by Fedoraproject
Salt by Saltstack
Salt by Saltstack
Salt by Saltstack
Salt by Saltstack
Salt by Saltstack
Salt by Saltstack
Salt by Saltstack
Salt by Saltstack
Salt by Saltstack
Salt by Saltstack
Salt by Saltstack
Salt by Saltstack
Salt by Saltstack
Salt by Saltstack
Salt by Saltstack
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attackers to execute arbitrary commands with the privileges of the salt-api service, potentially leading to data theft, lateral movement, or ransomware deployment.
Likely Case
Unauthorized command execution leading to privilege escalation, data exfiltration, or deployment of backdoors on managed systems.
If Mitigated
Limited impact if proper network segmentation, API authentication, and input validation are in place, though risk remains significant.
🎯 Exploit Status
Exploitation requires API access but is straightforward once access is obtained. The vulnerability is well-documented in security advisories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3002.5 and later
Vendor Advisory: https://github.com/saltstack/salt/releases
Restart Required: Yes
Instructions:
1. Backup configuration files. 2. Update SaltStack Salt to version 3002.5 or later using your package manager. 3. Restart salt-master and salt-api services. 4. Verify the update was successful.
🔧 Temporary Workarounds
Disable salt-api SSH client
linuxDisable or restrict access to the vulnerable SSH client functionality in salt-api if not required.
# Edit salt master config to disable SSH client
# Set 'ssh_client: False' in /etc/salt/master or equivalent
Restrict API access
linuxImplement network-level restrictions to limit which systems can access salt-api endpoints.
# Use firewall rules to restrict access
iptables -A INPUT -p tcp --dport 8000 -s trusted_network -j ACCEPT
iptables -A INPUT -p tcp --dport 8000 -j DROP
🧯 If You Can't Patch
- Implement strict network segmentation to isolate SaltStack management interfaces from untrusted networks
- Enforce strong authentication and authorization controls for salt-api access, including API key rotation and IP whitelisting
🔍 How to Verify
Check if Vulnerable:
Check Salt version: 'salt --versions-report' or 'salt-master --version'. If version is below 3002.5 and salt-api is enabled, the system is vulnerable.Check Version:
salt --versions-report | grep -i saltVerify Fix Applied:
After updating, verify version is 3002.5 or higher with 'salt --versions-report'. Test SSH client functionality through salt-api to ensure proper input validation.📡 Detection & Monitoring
Log Indicators:
- Unusual SSH client activity in salt-api logs
- Unexpected ProxyCommand or ssh_options parameters in API requests
- Failed authentication attempts followed by SSH client usage
Network Indicators:
- Unusual outbound connections from salt-master to unexpected destinations
- SSH traffic patterns inconsistent with normal Salt operations
SIEM Query:
source="salt-api" AND ("ProxyCommand" OR "ssh_options") AND status=success🔗 References
- https://github.com/saltstack/salt/releases
- https://lists.debian.org/debian-lts-announce/2021/11/msg00009.html
- https://lists.debian.org/debian-lts-announce/2022/01/msg00000.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7GRVZ5WAEI3XFN2BDTL6DDXFS5HYSDVB/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FUGLOJ6NXLCIFRD2JTXBYQEMAEF2B6XH/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YOGNT2XWPOYV7YT75DN7PS4GIYWFKOK5/
- https://saltproject.io/security_announcements/active-saltstack-cve-release-2021-feb-25/
- https://security.gentoo.org/glsa/202103-01
- https://security.gentoo.org/glsa/202310-22
- https://www.debian.org/security/2021/dsa-5011
- https://github.com/saltstack/salt/releases
- https://lists.debian.org/debian-lts-announce/2021/11/msg00009.html
- https://lists.debian.org/debian-lts-announce/2022/01/msg00000.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7GRVZ5WAEI3XFN2BDTL6DDXFS5HYSDVB/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FUGLOJ6NXLCIFRD2JTXBYQEMAEF2B6XH/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YOGNT2XWPOYV7YT75DN7PS4GIYWFKOK5/
- https://saltproject.io/security_announcements/active-saltstack-cve-release-2021-feb-25/
- https://security.gentoo.org/glsa/202103-01
- https://security.gentoo.org/glsa/202310-22
- https://www.debian.org/security/2021/dsa-5011
