Patchfirst
Patchfirst
CVE-2021-25281 Public exploit EPSS 73.1%

An issue was discovered in through SaltStack Salt before 3002.5. salt-api does not honor eauth credentials for the wheel_async client. Thus, an attacker can remotely run any wheel modules on the master.

Summary

The flaw is in salt-api, the API component of SaltStack Salt before version 3002.5, where the wheel_async client does not enforce eauth credentials. An attacker who can reach the salt-api service can remotely run any wheel module on the Salt master, with no need for valid authentication for that client.

Heading is the official description · CVE.org
Breakdown
66.5 / 100
Exploited
Yes, in VulnCheck KEV
Reports
0
Tactics
0/15

First seen exploited 5 years after disclosure. Public exploit code (Metasploit) was available 2 days before disclosure.

  1. Public exploit codeMetasploit2 days before
  2. Disclosedday 0
  3. First seen exploitedVulnCheck KEV evidence+5 yrs

8 fixes in salt over 4 months. The latest fix listed for salt is 3002.5.

Fixes in saltPyPI package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

  1. 3002.1CVE-2020-255926 Nov 2020
  2. 3002.3CVE-2021-2528427 Feb 2021
  3. 3002.3CVE-2021-314427 Feb 2021
  4. 3002.3CVE-2021-314827 Feb 2021
  5. 3002.5CVE-2021-2528127 Feb 2021
  6. 3002.5CVE-2021-2528227 Feb 2021
  7. 3002.5CVE-2021-2528327 Feb 2021
  8. 3002.5CVE-2021-319727 Feb 2021Latest listed

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: salt.

PyPIsaltGHSA-xxw3-765m-f37pPYSEC-2021-50

Upgrade to 3002.5 or later

Fixes this CVE and 4 other known vulnerabilities in this package (CVE-2020-16846, CVE-2020-25592, +2).

pippip install "salt>=3002.5"

The first fix for CVE-2021-25281.

Affected versions, by release line

If you runUpgrade to
3002 up to 3002.53002.5
3002 up to 3002.3

Still affected on this line by CVE-2021-25282 (fixed in 3002.5, a newer line); CVE-2021-3197 (fixed in 3002.5, a newer line).

3002.3
3001 up to 3001.53001.5
3001 up to 3001.4

Still affected on this line by CVE-2021-25282 (fixed in 3001.5, a newer line); CVE-2021-3197 (fixed in 3001.5, a newer line).

3001.4
3000 up to 3000.73000.7
3000 up to 3000.6

Still affected on this line by CVE-2021-25282 (fixed in 3000.7, a newer line); CVE-2021-3197 (fixed in 3000.7, a newer line).

3000.6
2019.2.6 up to 2019.2.82019.2.8
2019.2.0 up to 2019.2.82019.2.8
2019.2.0 up to 2019.2.5

Still affected on this line by CVE-2020-16846 (fixed in 2019.2.6, a newer line); CVE-2020-25592 (fixed in 2019.2.7, a newer line); CVE-2021-25282 (fixed in 2019.2.8, a newer line); CVE-2021-3197 (fixed in 2019.2.8, a newer line).

2019.2.5
2018.3.0rc1 up to 2019.2.0rc1

Still affected on this line by CVE-2020-11651 (fixed in 2019.2.4, a newer line); CVE-2020-11652 (fixed in 2019.2.4, a newer line).

2019.2.0rc1
2018.2.0 through 2018.3.5No fix published
2017.7.0 up to 2017.7.8

Still affected on this line by CVE-2020-11651 (fixed in 2019.2.4, a newer line); CVE-2020-11652 (fixed in 2019.2.4, a newer line).

2017.7.8
2017.5.0 up to 2017.7.8

Still affected on this line by CVE-2020-11651 (fixed in 2019.2.4, a newer line); CVE-2020-11652 (fixed in 2019.2.4, a newer line).

2017.7.8
2016.11.7 up to 2016.11.10

Still affected on this line by CVE-2020-11651 (fixed in 2019.2.4, a newer line); CVE-2020-11652 (fixed in 2019.2.4, a newer line).

2016.11.10
2016.11.4 up to 2016.11.5

Still affected on this line by CVE-2020-11651 (fixed in 2019.2.4, a newer line); CVE-2020-11652 (fixed in 2019.2.4, a newer line); CVE-2020-16846 (fixed in 2016.11.10, a newer line); CVE-2020-25592 (fixed in 2016.11.10, a newer line).

2016.11.6first fix for this CVE: 2016.11.5
2016.11.0 up to 2016.11.3

Still affected on this line by CVE-2020-11651 (fixed in 2019.2.4, a newer line); CVE-2020-11652 (fixed in 2019.2.4, a newer line); CVE-2020-16846 (fixed in 2016.11.10, a newer line); CVE-2020-25592 (fixed in 2016.11.10, a newer line); CVE-2021-25282 (fixed in 2016.11.5, a newer line); CVE-2021-3197 (fixed in 2016.11.5, a newer line).

2016.11.3
2016.3.7 up to 2016.3.8

Still affected on this line by CVE-2020-11651 (fixed in 2019.2.4, a newer line); CVE-2020-11652 (fixed in 2019.2.4, a newer line); CVE-2021-25282 (fixed in 2016.11.5, a newer line); CVE-2021-3197 (fixed in 2016.11.5, a newer line).

2016.3.8
2016.3.5 up to 2016.3.6

Still affected on this line by CVE-2020-11651 (fixed in 2019.2.4, a newer line); CVE-2020-11652 (fixed in 2019.2.4, a newer line); CVE-2020-16846 (fixed in 2016.3.8, a newer line); CVE-2020-25592 (fixed in 2016.3.8, a newer line); CVE-2021-25282 (fixed in 2016.11.5, a newer line); CVE-2021-3197 (fixed in 2016.11.5, a newer line).

2016.3.6
2016.3.0 up to 2016.11.5

Still affected on this line by CVE-2020-11651 (fixed in 2019.2.4, a newer line); CVE-2020-11652 (fixed in 2019.2.4, a newer line); CVE-2020-16846 (fixed in 2016.11.6, a newer line); CVE-2020-25592 (fixed in 2016.11.6, a newer line).

2016.11.5
2016.3.0 up to 2016.3.4

Still affected on this line by CVE-2020-11651 (fixed in 2019.2.4, a newer line); CVE-2020-11652 (fixed in 2019.2.4, a newer line); CVE-2020-16846 (fixed in 2016.3.8, a newer line); CVE-2020-25592 (fixed in 2016.3.8, a newer line); CVE-2021-25282 (fixed in 2016.11.5, a newer line); CVE-2021-3197 (fixed in 2016.11.5, a newer line).

2016.3.4
All versions before 2015.8.13

Still affected on this line by CVE-2020-11651 (fixed in 2019.2.4, a newer line); CVE-2020-11652 (fixed in 2019.2.4, a newer line).

2015.8.13
All versions before 2015.8.10

Still affected on this line by CVE-2020-11651 (fixed in 2019.2.4, a newer line); CVE-2020-11652 (fixed in 2019.2.4, a newer line).

2015.8.13first fix for this CVE: 2015.8.10

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

Also mentioned in 4 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

References

11 links, grouped by NVD tag

Other 4

github.com/saltstack/salt/releasessaltstack.com/blog/active-saltstack-cve-announced-2021-jan-21/saltproject.io/security_announcements/active-saltstack-cve-release-2021-feb-25/packetstormsecurity.com/files/162058/SaltStack-Salt-API-Unauthenticated-Remote-Command-Execution.html

vendor-advisory 6

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YOGNT2XWPOYV7YT75DN7PS4GIYWFKOK5/lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7GRVZ5WAEI3XFN2BDTL6DDXFS5HYSDVB/lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FUGLOJ6NXLCIFRD2JTXBYQEMAEF2B6XH/security.gentoo.org/glsa/202103-01debian.org/security/2021/dsa-5011security.gentoo.org/glsa/202310-22

mailing-list 1

lists.debian.org/debian-lts-announce/2021/11/msg00009.html
↑ ↓ chooseEnter openEsc close