CVE-2020-11652
SaltStack Salt Path Traversal Vulnerability
Description
CVE-2020-11652 is a medium-severity path traversal vulnerability in SaltStack Salt. The salt-master process ClearFuncs class allows access to methods that improperly sanitize paths, enabling authenticated users to perform arbitrary directory access on the Salt master server. This path traversal vulnerability affects SaltStack Salt before version 2019.2.4 and 3000 before 3000.2. CISA has added CVE-2020-11652 to its Known Exploited Vulnerabilities catalog, and with an EPSS score of 94.27% (99.9rd percentile), active exploitation is nearly certain.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| saltstack | salt | < 2019.2.4; >= 3000, < 3000.2 |
| opensuse | leap | 15.1 |
| debian | debian linux | 8.0; 9.0; 10.0 |
| canonical | ubuntu linux | 16.04; 18.04 |
| blackberry | workspaces server | <= 7.1.3; >= 8.0.0, <= 8.2.6; 9.1.0 |
| vmware | application remote collector | 7.5.0; 8.0.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
References
- http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00047.html(Mailing List, Third Party Advisory)
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00070.html(Mailing List, Third Party Advisory)
- http://packetstormsecurity.com/files/157560/Saltstack-3000.1-Remote-Code-Execution.html(Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/157678/SaltStack-Salt-Master-Minion-Unauthenticated-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- http://support.blackberry.com/kb/articleDetail?articleNumber=000063758(Third Party Advisory)
- http://www.vmware.com/security/advisories/VMSA-2020-0009.html(Third Party Advisory)
- https://docs.saltstack.com/en/latest/topics/releases/2019.2.4.html(Vendor Advisory)
- https://github.com/saltstack/salt/blob/v3000.2_docs/doc/topics/releases/3000.2.rst(Third Party Advisory)
- https://lists.debian.org/debian-lts-announce/2020/05/msg00027.html(Mailing List, Third Party Advisory)
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-salt-2vx545AG(Third Party Advisory)
- https://usn.ubuntu.com/4459-1/(Third Party Advisory)
- https://www.debian.org/security/2020/dsa-4676(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-11652(US Government Resource)
Weakness Type
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The SaltStack Salt master process improperly sanitizes path information provided through the ClearFuncs class methods. This path traversal weakness allows authenticated users to manipulate file path inputs to access directories and files outside the intended restricted scope on the Salt master server.
Learn more: CWE-22 — Improper Limitation of a Pathname to a Restricted Directory
Impact Analysis
CVE-2020-11652 carries a CVSS 3.1 score of 6.5 (MEDIUM), reflecting a moderate but significant risk. The vulnerability is remotely exploitable over the network with low attack complexity, though it requires low-level authentication. No user interaction is needed for exploitation. The primary impact is on confidentiality (High), allowing attackers to read sensitive files from the Salt master, including configuration files, Salt state data, and potentially credentials. Integrity and availability are not directly affected. With an EPSS score of 94.27% (99.9rd percentile), this vulnerability is almost certainly being actively exploited. This vulnerability is frequently chained with CVE-2020-11651, an authentication bypass in the same ClearFuncs class, which together allow unauthenticated remote attackers to both bypass authentication and traverse the filesystem.
Exploit Maturity
CVE-2020-11652 is confirmed as actively exploited through its listing in the CISA Known Exploited Vulnerabilities catalog. Public exploit code is available via Packet Storm Security, providing a complete proof of concept for remote code execution when combined with the authentication bypass in CVE-2020-11651. The EPSS score of 94.27% (99.9rd percentile) indicates near-certain exploitation activity. When combined with CVE-2020-11651, an authentication bypass vulnerability in the same salt-master ClearFuncs class, the attack becomes fully unauthenticated, significantly increasing the threat to exposed Salt masters.
Remediation
- Apply vendor patches immediately as mandated by CISA KEV: Apply updates per vendor instructions. Upgrade SaltStack Salt to version 2019.2.4 or 3000.2 or later.
- Verify that all Salt master instances running affected versions (SaltStack Salt < 2019.2.4 or >= 3000, < 3000.2) have been updated, including downstream distributions on openSUSE Leap 15.1, Debian Linux 8.0/9.0/10.0, Ubuntu Linux 16.04/18.04, BlackBerry Workspaces Server, and VMware Application Remote Collector.
- If immediate patching is not possible, restrict network access to the Salt master's ZeroMQ ports (default 4505/4506) to only trusted Salt minions and management systems using firewall rules and network segmentation.
- Audit Salt master logs for suspicious file access patterns and unexpected directory traversal attempts. Check for indicators of compromise related to unauthorized file reads or credential exfiltration.
- Implement filesystem-level access controls on the Salt master to restrict the Salt process's access to only necessary directories, and consider deploying file integrity monitoring to detect unauthorized access to sensitive configuration files.
Technical Details
CVE-2020-11652 affects the ClearFuncs class in the SaltStack Salt master process, which handles unauthenticated communication between the Salt master and its minions. Specific methods within this class fail to properly sanitize file path arguments, allowing path traversal sequences to escape the intended directory scope. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) reflects that while network-based exploitation is straightforward and only low privileges are needed, the impact is limited to confidentiality without direct integrity or availability consequences. This vulnerability is closely related to CVE-2020-11651, which bypasses authentication for the same ClearFuncs class, and the two vulnerabilities are commonly exploited together to achieve unauthenticated remote code execution on the Salt master and subsequently on all connected minions.
Frequently Asked Questions
Is CVE-2020-11652 being actively exploited?
Yes. CVE-2020-11652 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation. The EPSS score of 94.27% (99.9rd percentile) indicates near-certain exploitation, particularly when combined with CVE-2020-11651.
What products are affected by CVE-2020-11652?
CVE-2020-11652 affects SaltStack Salt versions before 2019.2.4 and versions 3000 before 3000.2. Additionally affected are openSUSE Leap 15.1, Debian Linux 8.0/9.0/10.0, Ubuntu Linux 16.04/18.04, BlackBerry Workspaces Server (up to 7.1.3, 8.0.0-8.2.6, 9.1.0), and VMware Application Remote Collector 7.5.0/8.0.0.
How do I fix CVE-2020-11652?
Upgrade SaltStack Salt to version 2019.2.4 or 3000.2 or later. If immediate patching is not possible, restrict network access to the Salt master's communication ports (4505/4506) and monitor for suspicious file access activity.
How severe is CVE-2020-11652?
CVE-2020-11652 has a CVSS 3.1 score of 6.5 (MEDIUM). While the direct impact is limited to confidentiality, the near-certain exploitation probability (94.27% EPSS) and its common use in combination with CVE-2020-11651 for full remote code execution make it a high-priority remediation target.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.