Path Traversal in SaltStack Salt (CVE‑2020‑11652) Enables Authenticated Directory Access
What It Is – SaltStack Salt’s clear_funcs routine in the salt‑master process fails to properly sanitize file‑path arguments, allowing an authenticated user to traverse directories and read arbitrary files on the master server.
Exploitability – The flaw requires a valid Salt user account; no public exploit code is known, but an attacker with credentials can weaponize it. CVSS v3.1 base score 7.5 (High).
Affected Products – SaltStack Salt (any version prior to the vendor‑released fix in 2020‑12‑02).
Why It Matters for Trust & Control Assurance
- Highlights the need for robust access‑control policies that enforce least‑privilege and separate duties for automation accounts.
- Demonstrates why continuous evidence of patch management and configuration hardening must be captured for audit readiness.
- Signals that logging and monitoring of privileged Salt commands are essential to detect abuse before data exposure.
Recommended Actions
- Apply SaltStack’s security patch (or upgrade to the latest Salt release).
- Review and tighten Salt user permissions; enforce least‑privilege and MFA where possible.
- Enable detailed audit logging for
salt‑masteroperations and integrate logs into a SIEM for continuous monitoring. - Validate that remediation steps are documented and can be presented as evidence during compliance audits.
Source: CISA KEV – CVE‑2020‑11652