CVE-2020-11652

What is SaltStack Salt?

Salt is a widely used open-source infrastructure automation and configuration management tool, similar in role to Ansible or Puppet. A central "salt-master" server pushes configuration and executes commands across a fleet of "minion" agents, meaning compromise of the master effectively grants an attacker control over every managed server in the environment — making Salt masters an extremely high-value target when exposed to untrusted networks.

Overview

CVE-2020-11652 is a directory traversal vulnerability in the salt-master's ClearFuncs class, the same component affected by the more severe companion vulnerability CVE-2020-11651 (an authentication bypass). While CVE-2020-11652 nominally requires some level of access to trigger, when chained with CVE-2020-11651's unauthenticated bypass, an attacker with no credentials at all could read and write arbitrary files anywhere on the salt-master's filesystem — including files needed to escalate to full remote code execution across the entire managed fleet.

Technical Details

The flaw (CWE-22, Path Traversal) exists because ClearFuncs methods that handle file-related requests did not adequately sanitize path arguments, allowing ../-style sequences to escape the intended directory and reach arbitrary filesystem locations. Combined with the sibling authentication-bypass bug, this gave attackers a path to read sensitive files (such as credentials or minion keys) and write files that could be leveraged for code execution — turning what looks like a modest path-traversal bug in isolation into a critical, wormable compromise primitive for any Salt master reachable from an untrusted network.

Discovery

Reported to SaltStack by security researchers at F-Secure, who published a technical advisory alongside the fix detailing both this vulnerability and its companion authentication bypass.

Exploitation Context

Exploitation began almost immediately after public disclosure in early May 2020: mass internet scanning for exposed Salt master ports (4505/4506) led to real-world compromises of several prominent organizations, including LineageOS's infrastructure and the Ghost blogging platform, within days of the advisory being published. CISA's KEV listing confirms continued exploitation of this vulnerability, underscoring how quickly attackers weaponize disclosed infrastructure-management vulnerabilities when exposed systems exist at scale.

Remediation

1. Apply the SaltStack patched release (Salt 2019.2.4 or 3000.2 and later) immediately.
2. Ensure salt-master ports 4505/4506 are never exposed to the public internet — restrict access to trusted internal networks only.
3. Rotate minion keys and audit master/minion configuration files for signs of tampering if the master was ever internet-reachable prior to patching.
4. Review salt-master logs for anomalous ClearFuncs requests or unexpected file access predating the patch.
5. Apply network segmentation and firewall rules around configuration-management infrastructure generally, given how much blast radius a compromised master provides.