CVE-2021-31607: Command Injection in SaltStack Salt

Sponsored Habilume Habit tracker with a companion that grows with you Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent. App Store Google Play

Background

SaltStack Salt is a popular configuration management and remote execution tool used for managing and securing large-scale infrastructure. It allows administrators to automate the deployment and configuration of software across multiple systems. However, a vulnerability has been discovered in versions 2016.9 through 3002.6 of SaltStack Salt that can lead to command injection and local privilege escalation on a minion. This vulnerability specifically affects the snapper module, which is responsible for managing file snapshots. By creating a file with a pathname that is backed up by snapper and exploiting the snapper.diff function, an attacker can execute arbitrary commands with elevated privileges.

Vulnerability Detail

The command injection vulnerability in SaltStack Salt allows an attacker to execute arbitrary commands with elevated privileges on a minion. To exploit this vulnerability, the attacker needs to create a file with a pathname that is backed up by snapper and trigger the snapper.diff function from the master. The snapper.diff function executes popen unsafely, allowing the attacker to inject malicious commands. This can lead to local privilege escalation, enabling the attacker to gain full control over the affected system. The severity of this vulnerability is rated as HIGH with a CVSS score of 7.8.

pip install --upgrade "salt==3008.3.0"

pip install --upgrade "salt==3003rc1"

Workaround

If upgrading to a fixed version is not immediately possible, a temporary workaround is to disable or restrict access to the snapper module in SaltStack Salt. By preventing the execution of the snapper.diff function, the command injection vulnerability can be mitigated. However, this workaround may impact the functionality of the snapper module and should only be considered as a temporary solution until the system can be upgraded to a fixed version.

Conclusion

In conclusion, the command injection vulnerability in SaltStack Salt can lead to local privilege escalation on a minion. It is crucial to upgrade to a fixed version of SaltStack Salt (version 3003rc1 or later) to mitigate this vulnerability. If immediate upgrading is not possible, disabling or restricting access to the snapper module can serve as a temporary workaround. For further support and assistance in vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for salt →

FAQ