Medium · published April 30, 2020
CVSS calls it medium at 6.5. It is confirmed in active exploitation. It sits in the 99.7th percentile for exploit probability.
⚠️ A crafty vulnerability lets authenticated users stroll through your directories! The SaltStack Salt process has a sneaky flaw that allows access to sensitive paths without proper sanitation. 🔍 It's like giving someone a backstage pass to a concert but forgetting to tell them which areas are off-limits. They could rummage through the tour bus or maybe even change the script for the performance! An attacker already logged in could exploit this vulnerability to access and manipulate sensitive files or directories, leading to unauthorized actions within your system. This could result in data leakage or unwanted changes that could disrupt your operations!
It's like giving someone a backstage pass to a concert but forgetting to tell them which areas are off-limits. They could rummage through the tour bus or maybe even change the script for the performance! The flaw in the salt-master's ClearFuncs class fails to properly sanitize path inputs, allowing authenticated users to gain access to arbitrary directories they shouldn't be able to reach. This is a classic case of insufficient input checking!
An attacker already logged in could exploit this vulnerability to access and manipulate sensitive files or directories, leading to unauthorized actions within your system. This could result in data leakage or unwanted changes that could disrupt your operations! To remediate, immediately upgrade to SaltStack Salt versions 2019.2.4 or 3000.2 and review your access controls to ensure users have only the permissions they need. It’s also wise to audit your system for any unauthorized directory access! This is fixable! Patch up and you'll have your system secured in no time. 🛡️