CVE-2021-31607: Command Injection Vulnerability in SaltStack Salt
Summary
CVE-2021-31607: In SaltStack Salt 2016.9 through 3002.6, a command injection vulnerability exists in the snapper module that allows for local privilege escalation on a minion. Affects salt versions >= 2016.11.0, < 3003rc1. Fixed in 3003rc1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
SaltStack Salt is an open-source configuration management and remote execution tool. It allows administrators to manage and automate the configuration of a large number of servers. The vulnerability in question affects versions 2016.9 through 3002.6 of Salt. This vulnerability specifically resides in the snapper module, which is responsible for managing snapshots of the file system. The issue allows for local privilege escalation on a minion when a file with a pathname backed up by snapper is created and the master calls the snapper.diff function. This function executes popen unsafely, leading to command injection.
Vulnerability Detail
The command injection vulnerability in SaltStack Salt allows an attacker to execute arbitrary commands with the privileges of the user running the Salt minion. To exploit this vulnerability, the attacker needs to create a file with a pathname that is backed up by snapper and then trigger the snapper.diff function from the master. This can result in local privilege escalation, potentially allowing the attacker to gain full control over the affected system. The vulnerability was assigned CVE-2021-31607.
How To Fix
Latest published version: 3008.3.0 as of 22 Oct 2026
pip install --upgrade "salt==3008.3.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3003rc1
This is the first release that contains the fix.
pip install --upgrade "salt==3003rc1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, users can disable the snapper module in Salt configuration if it is not required for their specific use case. This can be achieved by modifying the Salt configuration file and commenting out or removing the snapper module configuration. However, this workaround should only be considered temporary, and upgrading to a fixed version is strongly recommended.
Conclusion
In conclusion, the command injection vulnerability in SaltStack Salt (CVE-2021-31607) can lead to local privilege escalation on a minion. It is crucial to upgrade to a fixed version of Salt, such as 3003rc1 or later, to mitigate this vulnerability. Additionally, considering the privileges of the user running the Salt minion and applying necessary restrictions is recommended. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for salt →
FAQ
SaltStack Salt is an open-source configuration management and remote execution tool used for managing and automating the configuration of servers.
Versions 2016.9 through 3002.6 of Salt are affected by this vulnerability.
This vulnerability allows for local privilege escalation on a minion, potentially enabling an attacker to gain full control over the affected system.
To fix this vulnerability, it is recommended to upgrade to version 3003rc1 or any subsequent release of Salt. Additionally, reviewing and restricting the privileges of the user running the Salt minion is advisable.
Yes, a temporary workaround is to disable the snapper module in Salt configuration if it is not required for your specific use case. However, upgrading to a fixed version is strongly recommended.
Related vulnerabilities
Recent vulnerabilities recorded for salt.
