CVE-2022-22941
published 2022-03-29CVE-2022-22941: An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. When configured as a Master-of-Masters, with a publisher_acl, if a user…
PriorityP352high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
1.31%
67.2th percentile
An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. When configured as a Master-of-Masters, with a publisher_acl, if a user configured in the publisher_acl targets any minion connected to the Syndic, the Salt Master incorrectly interpreted no valid targets as valid, allowing configured users to target any of the minions connected to the syndic with their configured commands. This requires a syndic master combined with publisher_acl configured on the Master-of-Masters, allowing users specified in the publisher_acl to bypass permissions, publishing authorized commands to any configured minion.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| saltstack | salt | >= 0 < 3002.8 | 3002.8 |
| saltstack | salt | >= 3002 < 3002.8 | 3002.8 |
| saltstack | salt | >= 3003 < 3003.4 | 3003.4 |
| saltstack | salt | >= 3003 < 3003.4 | 3003.4 |
| saltstack | salt | >= 3004 < 3004.1 | 3004.1 |
| saltstack | salt | >= 3004 < 3004.1 | 3004.1 |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.0MEDIUMAV:N/AC:M/Au:S/C:P/I:P/A:P
cisa9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
SaltStack Salt Permissions Bypass
ghsa·2022-03-30
CVE-2022-22941 [HIGH] CWE-732 SaltStack Salt Permissions Bypass
SaltStack Salt Permissions Bypass
An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. When configured as a Master-of-Masters, with a publisher_acl, if a user configured in the publisher_acl targets any minion connected to the Syndic, the Salt Master incorrectly interpreted no valid targets as valid, allowing configured users to target any of the minions connected to the syndic with their configured commands. This requires a syndic master combined with publisher_acl configured on the Master-of-Masters, allowing users specified in the publisher_acl to bypass permissions, publishing authorized commands to any configured minion.
OSV
SaltStack Salt Permissions Bypass
osv·2022-03-30
CVE-2022-22941 [HIGH] SaltStack Salt Permissions Bypass
SaltStack Salt Permissions Bypass
An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. When configured as a Master-of-Masters, with a publisher_acl, if a user configured in the publisher_acl targets any minion connected to the Syndic, the Salt Master incorrectly interpreted no valid targets as valid, allowing configured users to target any of the minions connected to the syndic with their configured commands. This requires a syndic master combined with publisher_acl configured on the Master-of-Masters, allowing users specified in the publisher_acl to bypass permissions, publishing authorized commands to any configured minion.
OSV
CVE-2022-22941: An issue was discovered in SaltStack Salt in versions before 3002
osv·2022-03-29
CVE-2022-22941 CVE-2022-22941: An issue was discovered in SaltStack Salt in versions before 3002
An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. When configured as a Master-of-Masters, with a publisher_acl, if a user configured in the publisher_acl targets any minion connected to the Syndic, the Salt Master incorrectly interpreted no valid targets as valid, allowing configured users to target any of the minions connected to the syndic with their configured commands. This requires a syndic master combined with publisher_acl configured on the Master-of-Masters, allowing users specified in the publisher_acl to bypass permissions, publishing authorized commands to any configured minion.
CISA
Citrix ShareFile Improper Access Control Vulnerability
cisa·2022-03-25·CVSS 9.8
CVE-2021-22941 [CRITICAL] CWE-284 Citrix ShareFile Improper Access Control Vulnerability
Vulnerability: Citrix ShareFile Improper Access Control Vulnerability
Affected: Citrix ShareFile
Improper Access Control in Citrix ShareFile storage zones controller may allow an unauthenticated attacker to remotely compromise the storage zones controller.
Required Action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2021-22941
Remediation Due Date: 2022-04-15
Suricata
ET EXPLOIT Citrix ShareFile Storage Zones Controller RCE Attempt (CVE-2021-22941)
suricata·2022-01-25·CVSS 9.8
CVE-2021-22941 [CRITICAL] ET EXPLOIT Citrix ShareFile Storage Zones Controller RCE Attempt (CVE-2021-22941)
ET EXPLOIT Citrix ShareFile Storage Zones Controller RCE Attempt (CVE-2021-22941)
Rule: alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Citrix ShareFile Storage Zones Controller RCE Attempt (CVE-2021-22941)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/upload.aspx"; content:"id"; content:"|40|"; distance:0; content:"|2e 2e 2f|"; distance:0; content:"|2e|cshtml"; distance:0; fast_pattern; content:"bp"; content:"accountid"; http.header_names; to_lowercase; content:"|0d 0a|content-type|0d 0a|"; reference:cve,2021-22941; classtype:attempted-admin; sid:2034972; rev:3; metadata:attack_target Server, created_at 2022_01_25, cve CVE_2021_22941, deployment Perimeter, deployment Internal, confidence High, signature_severity Major, tag Exploit, ta
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/saltstack/salt/releases%2Chttps://repo.saltproject.io/https://saltproject.io/security_announcements/salt-security-advisory-release/%2Chttps://security.gentoo.org/glsa/202310-22https://github.com/saltstack/salt/releases%2Chttps://repo.saltproject.io/https://saltproject.io/security_announcements/salt-security-advisory-release/%2Chttps://security.gentoo.org/glsa/202310-22
2022-03-29
Published