CVE-2024-38824
📋 TL;DR
CVE-2024-38824 is a critical directory traversal vulnerability in SaltStack's recv_file method that allows attackers to write arbitrary files to the master cache directory. This affects SaltStack installations where the master is exposed to untrusted minions or network access. Attackers could potentially achieve remote code execution or compromise the Salt master.
💻 Affected Systems
- SaltStack
- Salt Project
📦 What is this software?
Salt by Saltstack
Salt by Saltstack
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution on Salt master, complete system compromise, lateral movement to all managed minions, and data exfiltration.
Likely Case
Arbitrary file write leading to configuration manipulation, privilege escalation, or denial of service through critical file overwrites.
If Mitigated
Limited impact if network segmentation restricts access to Salt master and proper authentication controls are enforced.
🎯 Exploit Status
Exploitation requires access to minion communication channel but is technically straightforward once access is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Salt 3006.12 or Salt 3007.4
Vendor Advisory: https://docs.saltproject.io/en/3006/topics/releases/3006.12.html
Restart Required: Yes
Instructions:
1. Backup Salt configuration and data. 2. Update Salt master using package manager: 'yum update salt-master' or 'apt-get update && apt-get install salt-master'. 3. Verify version with 'salt-master --version'. 4. Restart salt-master service: 'systemctl restart salt-master'. 5. Update minions to compatible versions.
🔧 Temporary Workarounds
Network Segmentation
linuxRestrict network access to Salt master ports (default 4505-4506) to trusted minions only.
iptables -A INPUT -p tcp --dport 4505 -s trusted_network -j ACCEPT
iptables -A INPUT -p tcp --dport 4506 -s trusted_network -j ACCEPT
iptables -A INPUT -p tcp --dport 4505 -j DROP
iptables -A INPUT -p tcp --dport 4506 -j DROP
File System Restrictions
linuxApply strict permissions to Salt master cache directory to limit file write capabilities.
chmod 700 /var/cache/salt/master
chown salt:salt /var/cache/salt/master
🧯 If You Can't Patch
- Implement strict network access controls to isolate Salt master from untrusted networks.
- Deploy intrusion detection systems to monitor for anomalous file writes in Salt cache directory.
🔍 How to Verify
Check if Vulnerable:
Check Salt master version: 'salt-master --version' and compare against affected versions (3006.x < 3006.12, 3007.x < 3007.4).Check Version:
salt-master --versionVerify Fix Applied:
Confirm version is 3006.12 or higher, or 3007.4 or higher using 'salt-master --version'. Test file write functionality with controlled minion commands.📡 Detection & Monitoring
Log Indicators:
- Unusual file write patterns in /var/cache/salt/master/
- Suspicious minion requests for file operations
- Errors in Salt master logs related to path traversal
Network Indicators:
- Anomalous traffic to Salt master ports (4505-4506) from unexpected sources
- Unusual file transfer patterns in Salt protocol
SIEM Query:
source="salt-master.log" AND ("path traversal" OR "directory traversal" OR "../" OR "..\")