Salt

Worker process denial of service through file read operation. .A vulnerability exists in the Master's “pub_ret” method which is exposed to all minions. The un-sanitized input value “jid” is used to construct a path which is then opened for reading. An attacker could exploit this vulnerabilities by attempting to read from a filename that will not return any data, e.g. by targeting a pipe node on the proc file system.

Published: 2025-06-13T07:08:12.518Z
Updated: 2025-06-17T17:25:29.513Z

File contents overwrite the VirtKey class is called when “on-demand pillar” data is requested and uses un-validated input to create paths to the “pki directory”. The functionality is used to auto-accept Minion authentication keys based on a pre-placed “authorization file” at a specific location and is present in the default configuration.

Published: 2025-06-13T07:04:38.695Z
Updated: 2025-06-17T17:26:12.653Z

Arbitrary directory creation or file deletion. In the find_file method of the GitFS class, a path is created using os.path.join using unvalidated input from the “tgt_env” variable. This can be exploited by an attacker to delete any file on the Master's process has permissions to.

Published: 2025-06-13T07:03:35.139Z
Updated: 2025-06-13T13:42:42.561Z

Arbitrary event injection on Salt Master. The master's "_minion_event" method can be used by and authorized minion to send arbitrary events onto the master's event bus.

Published: 2025-06-13T07:00:53.681Z
Updated: 2025-06-13T13:53:14.907Z

Directory traversal attack in minion file cache creation. The master's default cache is vulnerable to a directory traversal attack. Which could be leveraged to write or overwrite 'cache' files outside of the cache directory.

Published: 2025-06-13T06:58:19.550Z
Updated: 2025-06-13T13:55:43.520Z