CVE-2020-11651
Published: November 3, 2021
Official Description
SaltStack Salt contains an authentication bypass vulnerability in the salt-master process ClearFuncs due to improperly validating method calls. The vulnerability allows a remote user to access some methods without authentication, which can be used to retrieve user tokens from the salt master and/or run commands on salt minions. Salt users who follow fundamental internet security guidelines and best practices are not affected by this vulnerability.
CISA KEV Advisory
SaltStack Salt Authentication Bypass Vulnerability
SaltStack Salt contains an authentication bypass vulnerability in the salt-master process ClearFuncs due to improperly validating method calls. The vulnerability allows a remote user to access some methods without authentication, which can be used to retrieve user tokens from the salt master and/or run commands on salt minions. Salt users who follow fundamental internet security guidelines and best practices are not affected by this vulnerability.
Apply updates per vendor instructions.
Risk Analysis
This vulnerability in SaltStack Salt's salt-master process allows remote attackers to bypass authentication and access sensitive methods, potentially leading to the retrieval of user tokens or execution of commands on minions. The high EPSS score of 0.94421 signifies a very high likelihood of exploitation, making this a critical concern.
This vulnerability is actively exploited in the wild and is included in CISA's KEV catalog, confirming its confirmed exploitation. The flaw allows remote access without authentication.
Apply the latest security updates for SaltStack Salt. Ensure that salt-master instances are not directly exposed to the internet and follow fundamental internet security guidelines and best practices.
Technical Analysis
CVE-2020-11651 requires local access, meaning attackers must already have a foothold on the target system.
Exploitation requires some privileges, which limits the exposure to scenarios where an attacker has already gained initial access.
CISA has added CVE-2020-11651 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.
Exploit & PoC Resources
All References (1)
Quick Facts
Recommended Actions
- →Apply vendor patches immediately
- →Monitor CVE-2020-11651 in threat intel feeds
- →Review IDS/IPS signatures for exploitation attempts
- !CISA KEV: Federal agencies must patch per BOD 22-01 timeline
- !Active exploitation confirmed — treat as P1