Sign In
- Platform
- Solutions
- Modern NDR
- Resources
- Company
Platform
Modern NDR
Resources
Platform
Modern NDR
Resources
DETECTION OVERVIEW
Risk Factors
The Salt management framework is deployed in thousands of networks and Salt Master servers might be public-facing. An unauthenticated attacker can employ publicly-available exploit code to launch an attack. A successful exploit can enable the attacker to run root-level commands on any connected Salt device within a network.
Kill Chain
Risk Score
83
Salt is an open-source framework for managing devices within a network. Devices that run an agent, Salt Minions, connect to a Salt Master. The Salt Master monitors the state of Salt Minions and publishes update messages (including commands) to them. A vulnerability was discovered in the Salt Master that exposes two methods (_prep_auth_info and _send_pub) to an unauthenticated attacker. The attacker connects to the Salt Master on port 4506 to call these methods. The _send_pub method enables the attacker to queue arbitrary commands in the Salt Master that are then published to Salt Minions. The _prep_auth_info method returns the master authentication token to the attacker. This token allows the attacker to run administrative commands on the Salt Master. Ultimately, the attacker can gain complete control of the Salt Master and connected Salt Minions in the network.
