CVE-2020-16846
SaltStack Salt Shell Injection Vulnerability
Description
CVE-2020-16846 is a critical-severity shell injection vulnerability in SaltStack Salt. The Salt API, when used with the SSH client enabled, allows an unauthenticated user with network access to inject shell commands via crafted web requests, resulting in arbitrary code execution on the Salt master. This shell injection vulnerability affects SaltStack Salt through version 3002. CISA has added CVE-2020-16846 to its Known Exploited Vulnerabilities catalog, and with an EPSS score of 94.39% (99.97th percentile), exploitation is nearly certain for exposed Salt API instances.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| saltstack | salt | < 2015.8.10; >= 2015.8.11, < 2015.8.13; >= 2016.3.0, < 2016.3.4; >= 2016.3.5, < 2016.3.6; >= 2016.3.7, < 2016.3.8; >= 2016.11.0, < 2016.11.3; >= 2016.11.4, < 2016.11.6; >= 2016.11.7, < 2016.11.10; >= 2017.5.0, < 2017.7.4; >= 2017.7.5, < 2017.7.8; >= 2018.2.0, < 2018.3.5; >= 2019.2.0, < 2019.2.5; >= 3000.0, < 3000.3; 3001; 3002 |
| debian | debian linux | 9.0; 10.0 |
| fedoraproject | fedora | 31 |
| opensuse | leap | 15.1 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00029.html(Mailing List, Third Party Advisory)
- http://packetstormsecurity.com/files/160039/SaltStack-Salt-REST-API-Arbitrary-Command-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- https://github.com/saltstack/salt/releases(Release Notes)
- https://lists.debian.org/debian-lts-announce/2020/12/msg00007.html(Mailing List, Third Party Advisory)
- https://lists.debian.org/debian-lts-announce/2022/01/msg00000.html(Mailing List, Third Party Advisory)
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TPOGB2F6XUAIGFDTOCQDNB2VIXFXHWMA/(Release Notes)
- https://security.gentoo.org/glsa/202011-13(Third Party Advisory)
- https://www.debian.org/security/2021/dsa-4837(Mailing List, Third Party Advisory)
- https://www.saltstack.com/blog/on-november-3-2020-saltstack-publicly-disclosed-three-new-cves/(Broken Link, Vendor Advisory)
- https://www.zerodayinitiative.com/advisories/ZDI-20-1379/(Third Party Advisory, VDB Entry)
- https://www.zerodayinitiative.com/advisories/ZDI-20-1380/(Third Party Advisory, VDB Entry)
- https://www.zerodayinitiative.com/advisories/ZDI-20-1381/(Third Party Advisory, VDB Entry)
- https://www.zerodayinitiative.com/advisories/ZDI-20-1382/(Third Party Advisory, VDB Entry)
- https://www.zerodayinitiative.com/advisories/ZDI-20-1383/(Third Party Advisory, VDB Entry)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-16846(US Government Resource)
Weakness Type
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The SaltStack Salt API fails to properly neutralize user-supplied input before incorporating it into OS commands executed via the SSH client. When crafted web requests are sent to the Salt API, special shell characters are not sanitized, allowing an attacker to inject and execute arbitrary operating system commands on the Salt master server.
Learn more: CWE-78 — Improper Neutralization of Special Elements used in an OS Command
Impact Analysis
CVE-2020-16846 carries a CVSS 3.1 score of 9.8 (CRITICAL), representing the highest severity tier. The vulnerability is remotely exploitable over the network with low attack complexity, requires no authentication, and demands no user interaction. Successful exploitation fully compromises confidentiality, integrity, and availability, as an attacker gains the ability to execute arbitrary commands with the privileges of the Salt API process. With an EPSS score of 94.39% (99.97th percentile), exploitation is nearly certain for exposed instances. Since the Salt master typically manages many minion systems, successful exploitation of this vulnerability can lead to complete infrastructure compromise, affecting all systems managed by the compromised Salt master.
Exploit Maturity
CVE-2020-16846 is confirmed as actively exploited through its listing in the CISA Known Exploited Vulnerabilities catalog. Public exploit code is available via Packet Storm Security, providing a ready-to-use proof of concept for arbitrary command execution through the Salt REST API. The EPSS score of 94.39% (99.97th percentile) indicates near-certain exploitation activity. Multiple Zero Day Initiative advisories (ZDI-20-1379, ZDI-20-1380, ZDI-20-1381, ZDI-20-1382, ZDI-20-1383) document related vulnerabilities in the same Salt API surface, amplifying the overall risk.
Remediation
- Apply vendor patches immediately as mandated by CISA KEV: Apply updates per vendor instructions. Upgrade SaltStack Salt beyond version 3002 to the latest patched release available for your deployment branch.
- Verify that all Salt master instances running affected versions have been updated. The vulnerability affects a wide range of SaltStack Salt versions through 3002, spanning branches from 2015.8.x through 3002.
- If immediate patching is not possible, disable the Salt API service entirely or restrict network access to the Salt API endpoint using firewall rules. Ensure the SSH client integration is disabled if it is not actively required.
- Monitor Salt API access logs for suspicious requests, particularly those containing shell metacharacters or unusual command patterns. Review system logs on the Salt master for indicators of unauthorized command execution.
- After patching, audit the Salt master system for signs of prior compromise, including unauthorized SSH keys, modified configuration files, unexpected cron jobs, and unknown user accounts. Implement network segmentation to isolate the Salt master from untrusted network segments.
Technical Details
CVE-2020-16846 is a shell injection vulnerability in the SaltStack Salt REST API's SSH client integration. When the Salt API is configured with SSH client support enabled, user-supplied parameters in web requests are passed directly to shell commands without proper input sanitization. An attacker can craft HTTP requests containing shell metacharacters that are interpreted by the underlying shell, enabling arbitrary command execution on the Salt master system. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects the maximum exploitability: the attack is network-accessible, requires low complexity, no authentication, and no user interaction, with complete impact across all three CIA dimensions. The vulnerability spans an extensive range of SaltStack Salt versions from 2015.8.x through 3002, indicating that the vulnerable code pattern was present in the Salt API's SSH integration for many years before discovery and patching.
Frequently Asked Questions
Is CVE-2020-16846 being actively exploited?
Yes. CVE-2020-16846 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. The EPSS score of 94.39% (99.97th percentile) indicates near-certain exploitation. Public exploit code is readily available.
What products are affected by CVE-2020-16846?
CVE-2020-16846 affects SaltStack Salt through version 3002, covering branches from 2015.8.x through 3002. Additionally affected are Debian Linux 9.0/10.0, Fedora 31, and openSUSE Leap 15.1 distributions that include vulnerable Salt packages.
How do I fix CVE-2020-16846?
Upgrade SaltStack Salt beyond version 3002 to the latest available patched release. If immediate patching is not possible, disable the Salt API or restrict its network exposure and disable the SSH client integration.
How severe is CVE-2020-16846?
CVE-2020-16846 has a CVSS 3.1 score of 9.8 (CRITICAL). It enables unauthenticated remote command execution through the Salt API, with the 94.39% EPSS score confirming near-certain exploitation. The vulnerability demands immediate remediation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.