published February 27, 2021
NVD has not assigned a CVSS score to this record. It sits in the 99.4th percentile for exploit probability.
⚡ A sneaky shell injection hides in the SaltStack Salt API, lurking right in the ssh client! 🦸 Think of it like a chef who lets diners customize their orders so much that they accidentally slip in some harmful ingredients — allowing unexpected surprises in the kitchen! 🍽️ An attacker could exploit this to run malicious commands on the server, potentially leading to unauthorized access or system compromise. Imagine the chaos if a rogue chef decided to transform your entire menu without you noticing!
Think of it like a chef who lets diners customize their orders so much that they accidentally slip in some harmful ingredients — allowing unexpected surprises in the kitchen! 🍽️ This vulnerability allows a shell injection through the ProxyCommand argument or ssh_options in an API call, enabling an attacker to execute arbitrary commands on the system.
An attacker could exploit this to run malicious commands on the server, potentially leading to unauthorized access or system compromise. Imagine the chaos if a rogue chef decided to transform your entire menu without you noticing! Upgrade your SaltStack Salt to version 3002.5 or later to patch this vulnerability. Additionally, review your API request configurations to ensure no unintended commands can be injected. 🛡️ You've got this! Stay proactive and secure your systems today. 🚀