CVE-2020-11651 SaltStack Salt Authentication Bypass

What is CVE-2020-11651?

CVE-2020-11651 is a critical authentication bypass vulnerability in Canonical Ubuntu Linux, published on 30 Apr 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class does not properly validate method calls. This allows a remote user to access some methods without authentication. These methods can be used to retrieve user tokens from the salt master and/or run arbitrary commands on salt minions.

Which versions are affected by CVE-2020-11651?

5 open source packages ship an affected version, including salt. It affects 5 products.

Products include Canonical Ubuntu Linux, Debian Debian Linux, Opensuse Leap, Saltstack Salt, Vmware Application Remote Collector.

How do I fix CVE-2020-11651?

Upgrade salt to a fixed version for your release line: 2019.2.4 or 3000.2. US federal agencies must fix it by 3 May 2022.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2020-11651 being exploited?

Yes. Attackers have exploited CVE-2020-11651 in the wild since at least 3 Nov 2021.

Public exploit code: 2 Metasploit modules, 1 Exploit-DB entry and 15 proofs of concept on GitHub.

Other vulnerabilities in Canonical Ubuntu Linux

• CVE-2020-7247 OpenSMTPD Remote Code Execution Exploited Critical 9.8
• CVE-2019-16928 Exim Out-of-bounds Write Exploited Critical 9.8
• CVE-2018-6789 Exim Buffer Overflow Exploited Critical 9.8
• CVE-2015-2590 Oracle Java SE and Java SE Embedded Remote Code Execution Exploited Critical 9.8
• CVE-2013-0422 Oracle JRE Remote Code Execution Exploited Critical 9.8

All Canonical Ubuntu Linux vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-pjhf-vpx3-33r3, PYSEC-2020-102, UBUNTU-CVE-2020-11651.