r/saltstack • u/nobullvegan • Apr 24 '20

Salt Master Vulnerability Discovered

SaltStack have announced that there's a vulnerability in salt-master.

https://github.com/saltstack/community/blob/master/doc/Community-Message.pdf

Considering what else they're recommending, I presume this is exploitable before minions are authenticated, but that's purely speculation on my part.

TLDR: Critical vulnerability in Salt master. They're suggesting preventing network access from unauthorised users and then patching as soon as possible. Fix available on the 29th (Wednesday).

EDIT 29/04/20: Fix released: https://www.reddit.com/r/saltstack/comments/gahkc5/saltstack_30002_released_security_fix/

47 Upvotes

96% Upvoted

19 comments sorted by

View all comments

3

u/irve Apr 24 '20

I would presume remote execution on that alert level.

1

u/vortexman100 Apr 29 '20

And you were right! Unautheticated remote command execution on all salt-minions. Nice.