CVE-2020-11651: SaltStack Salt Auth Bypass Vulnerability

CVE-2020-11651 Overview

An authentication bypass vulnerability was discovered in SaltStack Salt before version 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class does not properly validate method calls, allowing a remote unauthenticated attacker to access certain methods without authentication. These methods can be leveraged to retrieve user tokens from the salt master and/or execute arbitrary commands on salt minions, leading to complete infrastructure compromise.

Critical Impact

This vulnerability enables unauthenticated remote attackers to bypass authentication controls, steal user tokens, and execute arbitrary commands across all managed Salt minions, potentially compromising entire infrastructure deployments. This vulnerability is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild.

Affected Products

• SaltStack Salt versions before 2019.2.4
• SaltStack Salt 3000 versions before 3000.2
• openSUSE Leap 15.1
• Debian Linux 8.0, 9.0, 10.0
• Canonical Ubuntu Linux 16.04 ESM, 18.04 LTS
• VMware Application Remote Collector 7.5.0, 8.0.0

Discovery Timeline

• April 30, 2020 - CVE-2020-11651 published to NVD
• November 7, 2025 - Last updated in NVD database

Technical Details for CVE-2020-11651

Vulnerability Analysis

The vulnerability resides in the ClearFuncs class within the SaltStack Salt master process. This class is responsible for handling unauthenticated network requests on the ZeroMQ message bus (typically on ports 4505 and 4506). Due to improper validation of method calls, the class exposes methods that should require authentication to unauthenticated clients.

The flaw allows attackers to call sensitive methods such as _prep_auth_info() and _send_pub() without providing valid credentials. The _prep_auth_info() method returns the root key used to authenticate commands on the local master, while _send_pub() can be used to send arbitrary messages that minions will execute as commands.

This authentication bypass is particularly dangerous in SaltStack environments because the Salt master typically has administrative control over all connected minions. An attacker exploiting this vulnerability can effectively execute commands with root privileges across the entire managed infrastructure.

Root Cause

The root cause is insufficient access control validation in the ClearFuncs class. The class does not properly restrict which methods can be called by unauthenticated network clients. Specifically, the method dispatch mechanism fails to verify that incoming requests to sensitive internal methods originate from authenticated sessions, allowing any network-accessible client to invoke privileged functionality.

Attack Vector

The attack is network-based and requires no user interaction or prior authentication. An attacker needs network access to the Salt master's ZeroMQ ports (default ports 4505/4506). The exploitation flow involves:

1. The attacker connects to the Salt master's exposed ports
2. The attacker invokes the _prep_auth_info() method to obtain the root authentication key
3. Using the retrieved root key, the attacker can authenticate arbitrary commands
4. The attacker uses _send_pub() to dispatch malicious commands to connected minions
5. All targeted minions execute the attacker's commands with root privileges

The attack does not require valid credentials, making any internet-exposed Salt master installation an immediate target. Public exploit code is available through Packet Storm, significantly lowering the barrier for exploitation.

Detection Methods for CVE-2020-11651

Indicators of Compromise

• Unexpected connections to Salt master ports (4505/4506) from unknown IP addresses
• Suspicious authentication requests in Salt master logs without corresponding valid sessions
• Unexpected command execution across Salt minions, particularly commands containing reverse shells or malware downloads
• Unusual process spawning on Salt minions following Salt-related network activity
• Evidence of root key extraction attempts in Salt master debug logs

Detection Strategies

• Monitor network traffic to ports 4505 and 4506 for connections from unauthorized IP addresses or external networks
• Implement intrusion detection rules to identify exploitation patterns, such as rapid authentication method calls from unauthenticated sources
• Enable verbose logging on Salt masters to capture method invocation attempts on the ClearFuncs class
• Deploy endpoint detection to identify unauthorized command execution on Salt minions
• Review Salt master access logs for anomalous patterns, including method calls to _prep_auth_info() or _send_pub()

Monitoring Recommendations

• Configure network monitoring to alert on external connections to Salt master ZeroMQ ports
• Implement SIEM correlation rules to detect Salt master authentication anomalies followed by minion command execution
• Establish baseline monitoring of legitimate Salt command patterns to identify deviations
• Deploy file integrity monitoring on Salt master configuration files to detect unauthorized modifications

How to Mitigate CVE-2020-11651

Immediate Actions Required

• Upgrade SaltStack Salt immediately to version 2019.2.4 or 3000.2 or later
• Restrict network access to Salt master ports (4505/4506) using firewall rules to allow only trusted minion IP addresses
• Audit Salt master logs for evidence of prior exploitation attempts
• Regenerate Salt master keys if compromise is suspected
• Review and terminate any suspicious processes on Salt minions

Patch Information

SaltStack has released patched versions that address this vulnerability. Organizations should upgrade to the following versions or later:

• For the 2019.2.x branch: upgrade to version 2019.2.4 or later
• For the 3000.x branch: upgrade to version 3000.2 or later

Detailed release notes are available in the SaltStack Release Notes 2019.2.4 and SaltStack Documentation for 3000.2.

Additional vendor security advisories:

• VMware Security Advisory VMSA-2020-0009
• Debian Security Advisory DSA-4676
• Ubuntu Security Notice USN-4459-1
• Cisco Security Advisory for Salt

Workarounds

• Block external access to Salt master ports 4505 and 4506 using network firewalls or security groups
• Implement network segmentation to isolate Salt infrastructure from untrusted networks
• Consider disabling the Salt master temporarily if immediate patching is not possible and the system is exposed to untrusted networks
• Enable Salt master's client_acl configuration to restrict which commands can be executed
• Deploy a VPN or jump host requirement for any administrative access to Salt infrastructure

# Firewall configuration example to restrict Salt master access
# Allow only trusted minion subnets to access Salt master ports

# Using iptables
iptables -A INPUT -p tcp --dport 4505 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 4506 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 4505 -j DROP
iptables -A INPUT -p tcp --dport 4506 -j DROP

# Using firewalld
firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="10.0.0.0/8" port protocol="tcp" port="4505-4506" accept'
firewall-cmd --permanent --add-rich-rule='rule family="ipv4" port protocol="tcp" port="4505-4506" drop'
firewall-cmd --reload