CVE-2020-11651
SaltStack Salt Authentication Bypass Vulnerability
Description
CVE-2020-11651 is a critical-severity authentication bypass vulnerability in SaltStack Salt. The salt-master process ClearFuncs class does not properly validate method calls, allowing a remote unauthenticated user to access methods that can retrieve user tokens and run arbitrary commands on Salt minions. This authentication bypass vulnerability affects SaltStack Salt before version 2019.2.4 and 3000 before 3000.2. CISA has added CVE-2020-11651 to its Known Exploited Vulnerabilities catalog, and with an EPSS score of 94.42% (99.98th percentile), exploitation is nearly certain for any exposed Salt master.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| saltstack | salt | < 2019.2.4; >= 3000, < 3000.2 |
| opensuse | leap | 15.1 |
| debian | debian linux | 8.0; 9.0; 10.0 |
| canonical | ubuntu linux | 16.04; 18.04 |
| vmware | application remote collector | 7.5.0; 8.0.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00047.html(Mailing List, Third Party Advisory)
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00070.html(Mailing List, Third Party Advisory)
- http://packetstormsecurity.com/files/157560/Saltstack-3000.1-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/157678/SaltStack-Salt-Master-Minion-Unauthenticated-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- http://www.vmware.com/security/advisories/VMSA-2020-0009.html(Third Party Advisory)
- https://docs.saltstack.com/en/latest/topics/releases/2019.2.4.html(Vendor Advisory)
- https://github.com/saltstack/salt/blob/v3000.2_docs/doc/topics/releases/3000.2.rst(Third Party Advisory)
- https://lists.debian.org/debian-lts-announce/2020/05/msg00027.html(Mailing List, Third Party Advisory)
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-salt-2vx545AG(Third Party Advisory)
- https://usn.ubuntu.com/4459-1/(Third Party Advisory)
- https://www.debian.org/security/2020/dsa-4676(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-11651(US Government Resource)
Weakness Type
CWE-287: Improper Authentication
The SaltStack Salt master's ClearFuncs class fails to properly validate incoming method calls, allowing remote users to invoke sensitive methods without providing valid authentication credentials. This improper authentication weakness enables attackers to retrieve master tokens and execute arbitrary commands across the entire Salt infrastructure.
Learn more: CWE-287 — Improper Authentication
Impact Analysis
CVE-2020-11651 carries a CVSS 3.1 score of 9.8 (CRITICAL), representing the highest severity tier. The vulnerability is remotely exploitable over the network with low attack complexity, requires no authentication, and demands no user interaction. Successful exploitation fully compromises confidentiality, integrity, and availability of the Salt master and all connected Salt minions. An attacker can retrieve user tokens to impersonate legitimate administrators and execute arbitrary commands across the entire managed infrastructure, potentially affecting hundreds or thousands of systems. With an EPSS score of 94.42% (99.98th percentile), exploitation is nearly certain for exposed systems. This vulnerability is commonly chained with CVE-2020-11652, a path traversal flaw in the same ClearFuncs class, enabling attackers to both bypass authentication and access arbitrary files on the Salt master.
Exploit Maturity
CVE-2020-11651 is confirmed as actively exploited through its listing in the CISA Known Exploited Vulnerabilities catalog. Public exploit code is available through multiple sources, including Packet Storm Security and a second exploit demonstrating full unauthenticated remote code execution. The EPSS score of 94.42% (99.98th percentile) indicates near-certain exploitation activity. When combined with CVE-2020-11652, a path traversal vulnerability in the same ClearFuncs class, the attack chain provides both authentication bypass and arbitrary file access, enabling complete compromise of the Salt infrastructure.
Remediation
- Apply vendor patches immediately as mandated by CISA KEV: Apply updates per vendor instructions. Upgrade SaltStack Salt to version 2019.2.4 or 3000.2 or later.
- Verify that all Salt master instances running affected versions (SaltStack Salt < 2019.2.4 or >= 3000, < 3000.2) have been updated, including downstream deployments on openSUSE Leap 15.1, Debian Linux 8.0/9.0/10.0, Ubuntu Linux 16.04/18.04, and VMware Application Remote Collector 7.5.0/8.0.0.
- If immediate patching is not possible, block all external access to the Salt master's ZeroMQ publisher (port 4505) and request server (port 4506) using firewall rules. Only trusted internal Salt minions should have network access to these ports.
- Rotate all Salt master keys, tokens, and credentials immediately after patching, as existing tokens may have been compromised. Audit Salt minion configurations for unauthorized changes or backdoor states.
- Monitor Salt master logs for authentication anomalies, unexpected token retrievals, and command execution from unknown sources. Conduct forensic analysis to determine if the vulnerability was exploited prior to patching.
Technical Details
CVE-2020-11651 resides in the ClearFuncs class of the SaltStack Salt master process, which handles the ZeroMQ-based communication protocol between the master and its minions. The class exposes methods intended for internal use that fail to validate the authentication status of incoming requests. Specifically, an unauthenticated remote attacker can invoke the _prep_auth_info() and _send_pub() methods to retrieve the root key used for Salt master authentication and subsequently issue arbitrary commands to all connected Salt minions via the publish mechanism. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects the maximum exploitability: network-accessible, low complexity, no privileges or interaction required, with complete impact across confidentiality, integrity, and availability. This vulnerability is architecturally related to CVE-2020-11652, as both exploit insufficient access controls in the same ClearFuncs class.
Frequently Asked Questions
Is CVE-2020-11651 being actively exploited?
Yes. CVE-2020-11651 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. The EPSS score of 94.42% (99.98th percentile) indicates near-certain exploitation for exposed Salt masters. Multiple public exploits are available.
What products are affected by CVE-2020-11651?
CVE-2020-11651 affects SaltStack Salt versions before 2019.2.4 and versions 3000 before 3000.2. Additionally affected are openSUSE Leap 15.1, Debian Linux 8.0/9.0/10.0, Ubuntu Linux 16.04/18.04, and VMware Application Remote Collector 7.5.0/8.0.0.
How do I fix CVE-2020-11651?
Upgrade SaltStack Salt to version 2019.2.4 or 3000.2 or later. Immediately restrict network access to Salt master ports 4505/4506 and rotate all Salt master keys and tokens after patching.
How severe is CVE-2020-11651?
CVE-2020-11651 has a CVSS 3.1 score of 9.8 (CRITICAL). It allows unauthenticated remote code execution across the entire Salt infrastructure, making it one of the most severe vulnerabilities in configuration management tools. The 94.42% EPSS score confirms near-certain exploitation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.