CVE-2020-11652 SaltStack Salt Path Traversal
Authenticated users can exploit improper path sanitization in SaltStack Salt to access arbitrary directories on the master server.
- Exploited in the wild
- Since 3 Nov 2021
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-11652?
CVE-2020-11652 is a medium-severity path traversal vulnerability in Canonical Ubuntu Linux, published on 30 Apr 2020. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class allows access to some methods that improperly sanitize paths. These methods allow arbitrary directory access to authenticated users.
Weakness: CWE-22
Which versions are affected by CVE-2020-11652?
5 open source packages ship an affected version, including salt. It affects 6 products.
| Package | Affected | Fixed in |
|---|---|---|
salt PyPI | All versions | 2019.2.4, 3000.2 |
salt PyPI | All versions | 2019.2.4 |
salt PyPI | All versions | 2019.2.4 |
salt PyPI | From 3000 | 3000.2 |
salt PyPI | From 3000 | 3000.2 |
Products include Blackberry Workspaces Server, Canonical Ubuntu Linux, Debian Debian Linux, Opensuse Leap, Saltstack Salt, Vmware Application Remote Collector.
How do I fix CVE-2020-11652?
Upgrade salt to a fixed version for your release line: 2019.2.4 or 3000.2. US federal agencies must fix it by 3 May 2022.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2020-11652 being exploited?
Yes. Attackers have exploited CVE-2020-11652 in the wild since at least 3 Nov 2021.
Public exploit code: 2 Metasploit modules, 1 Exploit-DB entry and 3 proofs of concept on GitHub.
Other vulnerabilities in Canonical Ubuntu Linux
Sources
Also known as GHSA-vp49-2g4r-m3x3, PYSEC-2020-103, UBUNTU-CVE-2020-11652.