{"id":99307,"date":"2021-03-02T16:23:36","date_gmt":"2021-03-02T14:23:36","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/opasnye-uyazvimosti-v-sisteme-upravleniya-konfiguracziej-saltstack"},"modified":"2021-03-02T16:23:36","modified_gmt":"2021-03-02T14:23:36","slug":"opasnye-uyazvimosti-v-sisteme-upravleniya-konfiguracziej-saltstack","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/opasnye-uyazvimosti-v-sisteme-upravleniya-konfiguracziej-saltstack","title":{"rendered":"Critical vulnerabilities in the SaltStack configuration management system","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
In the new releases of the centralized configuration management system SaltStack 3002.5, 3001.6, and 3000.8, a vulnerability (CVE-2020-28243) has been fixed that allowed an unprivileged local user of the host to escalate their privileges in the system. The issue was caused by a bug in the salt-minion handler used to receive commands from the central server. The vulnerability was identified in November but was only fixed now. <\/p>\n
When performing the operation «restartcheck», there is a possibility of injecting arbitrary commands by manipulating the process name. In particular, the request to check for the package was made by launching the package manager with an argument derived from the process name. The package manager is initiated by calling the popen function in shell mode, but without escaping special characters. By changing the process name and using characters like «;» and «|», one can execute their own code. <\/p>\n
In addition to the noted issue in SaltStack 3002.5, nine other vulnerabilities have been fixed: <\/p>\n
\n
CVE-2021-25281 \u2014 due to a lack of proper authorization checks, a remote attacker can invoke any wheel module on the master server side through a call to SaltAPI and compromise the entire infrastructure.\n
CVE-2021-3197 \u2014 an issue in the SSH module to the minion, allowing arbitrary shell commands to be executed by substituting an argument with the «ProxyCommand» setting or passing ssh_options through the API.\n
CVE-2021-25282 \u2014 unauthorized access to wheel_async allows rewriting a file outside the base directory and executing arbitrary code on the system through a call to SaltAPI.\n
CVE-2021-25283 \u2014 a directory traversal vulnerability in the wheel.pillar_roots.write handler in SaltAPI allows adding arbitrary templates to the jinja renderer.\n
CVE-2021-25284 \u2014 passwords set via webutils were recorded in plain text in the log \/var\/log\/salt\/minion.\n
CVE-2021-3148 \u2014 command injection is possible through a SaltAPI call to salt.utils.thin.gen_thin().\n