{
  "Name": "SaltStack RCE (CVE-2020-11651)",
  "Description": "An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class does not properly validate method calls. This allows a remote user to access some methods without authentication. These methods can be used to retrieve user tokens from the salt master and/or run arbitrary commands on salt minions.",
  "Product": "SaltStack",
  "Homepage": "https://www.saltstack.com/",
  "DisclosureDate": "2020-04-30",
  "Author": "gobysec@gmail.com",
  "GifAddress": "https://raw.githubusercontent.com/gobysec/GobyVuls/master/SaltStack/CVE-2020-11651/CVE-2020-11651.gif",
  "FofaQuery": "protocol==zmtp",
  "GobyQuery": "protocol==zmtp",
  "Level": "3",
  "Impact": "Remote attacker can use this default to control the server.",
  "Recommendation": "Upgrade from https://docs.saltstack.com/en/latest/topics/releases/2019.2.4.html",
  "References": [
    "http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00047.html",
    "http://packetstormsecurity.com/files/157560/Saltstack-3000.1-Remote-Code-Execution.html",
    "http://www.vmware.com/security/advisories/VMSA-2020-0009.html",
    "https://docs.saltstack.com/en/latest/topics/releases/2019.2.4.html",
    "https://github.com/saltstack/salt/blob/v3000.2_docs/doc/topics/releases/3000.2.rst",
    "https://www.debian.org/security/2020/dsa-4676",
    "https://nvd.nist.gov/vuln/detail/CVE-2020-11651",
    "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11651"
  ],
  "HasExp": true,
  "ExpParams": [
	{
		  "name": "AttackType",
		  "type": "select",
		  "value": "cmd,goby_shell_linux"
	},
    {
      "Name": "cmd",
      "Type": "input",
      "Value": "whoami",
	  "show": "AttackType=cmd"
    }
  ],
  "ExpTips": {
    "Type": "",
    "Content": ""
  },
  "ScanSteps": null,
  "ExploitSteps": null,
  "Tags": null,
  "CVEIDs": [
    "CVE-2020-11651"
  ],
  "CVSSScore": "9.8",
  "AttackSurfaces": {
    "Application": null,
    "Support": null,
    "Service": null,
    "System": null,
    "Hardware": null
  }
}