CVE-2021-33226 Code injection in n/a
An attacker could potentially execute arbitrary code via the func variable in SaltStack, though the exploitability is disputed.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-33226?
CVE-2021-33226 is a critical code injection vulnerability in Saltstack Salt, published on 17 Feb 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Buffer Overflow vulnerability in Saltstack v.3003 and before allows attacker to execute arbitrary code via the func variable in salt/salt/modules/status.py file. NOTE: this is disputed by third parties because an attacker cannot influence the eval input
Weakness: CWE-120
Which versions are affected by CVE-2021-33226?
1 open source package ship an affected version, including salt. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
salt PyPI | All versions | 3003.1 |
Products include Saltstack Salt.
How do I fix CVE-2021-33226?
Upgrade salt to 3003.1 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2021-33226 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-33226 exists.
Other vulnerabilities in Saltstack Salt
- CVE-2013-4437 SaltStack insecurely uses /tmp
- CVE-2013-6617 SaltStack Privilege Escalation vulnerability
- CVE-2021-25315 salt-api unauthenticated remote code execution
- CVE-2018-15751 SaltStack Salt Remote command execution and incorrect access control when using salt-api
- CVE-2017-7893 SaltStack Salt allows compromised salt-minions to impersonate the salt-master
Sources
Also known as GHSA-3cjm-9wq5-p7gj, PYSEC-2023-47.