CVE-2021-22004: SaltStack Salt Config File Subversion Vulnerability
Summary
CVE-2021-22004: An issue was discovered in SaltStack Salt before 3003.3. Affects salt versions < 3c609c16ee0454217f339e987c03eaf61662a853. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
SaltStack Salt is an open-source configuration management and remote execution software. It is widely used for managing and automating infrastructure. The vulnerability, identified as CVE-2021-22004, allows a malicious actor to subvert the proper behavior of the Salt minion software by exploiting a flaw in the minion installer. The installer accepts and uses a minion config file located at C:\salt\conf if it exists before the installation process. This can be leveraged by an attacker to manipulate the configuration and potentially compromise the system.
Vulnerability Detail
The vulnerability arises from the Salt minion installer's acceptance and utilization of a minion config file at C:\salt\conf. By placing a malicious config file in this location before running the installer, an attacker can control the behavior of the Salt minion software. This can lead to unauthorized access, privilege escalation, and other security breaches. The impact of this vulnerability depends on the privileges of the user running the installer and the actions performed by the Salt minion software.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can manually remove any existing minion config file at C:\salt\conf before running the Salt minion installer. This ensures that the installer will not use any potentially malicious config file and will create a new one with default settings. However, this workaround may not be feasible in all scenarios, and it is strongly advised to update to the latest version of SaltStack Salt as soon as possible.
Conclusion
CVE-2021-22004 is a vulnerability in SaltStack Salt that allows an attacker to subvert the proper behavior of the Salt minion software by manipulating the minion config file. To mitigate this vulnerability, it is crucial to update SaltStack Salt to version 3003.3 or later and follow the recommended upgrade process. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for salt →
FAQ
SaltStack Salt is an open-source configuration management and remote execution software used for managing and automating infrastructure.
The vulnerability allows an attacker to manipulate the behavior of the Salt minion software, potentially leading to unauthorized access, privilege escalation, and other security breaches.
To fix this vulnerability, update SaltStack Salt to version 3003.3 or later and follow the recommended upgrade process provided by the SaltStack community.
A workaround is to manually remove any existing minion config file at C:\salt\conf before running the Salt minion installer. However, it is strongly advised to update to the latest version of SaltStack Salt as soon as possible.
You can find more information about CVE-2021-22004 in the official CVE database or the SaltStack community resources.
Related vulnerabilities
Recent vulnerabilities recorded for salt.
