CVE-2024-22232: Salt Master Path Traversal Vulnerability

CVE-2024-22232 Overview

CVE-2024-22232 is a directory traversal vulnerability in the Salt file server component of the SaltStack (Salt) configuration management platform. An authenticated user can craft a specially formed URL that escapes the intended file server root directory. This allows the attacker to read arbitrary files from the Salt master's filesystem. The flaw is categorized under [CWE-22] (Improper Limitation of a Pathname to a Restricted Directory) and affects the confidentiality of any file readable by the Salt master process, including credentials, private keys, and pillar data.

Critical Impact
A malicious user with low-privileged access can read arbitrary files from a Salt master's filesystem, exposing sensitive configuration, secrets, and infrastructure data.

Affected Products

Salt Project (SaltStack) — Salt master file server component
Deployments exposing the Salt master API or file server to authenticated users
Refer to the Salt Project Security Advisory for exact affected versions

Discovery Timeline

2024-06-27 - CVE-2024-22232 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-22232

Vulnerability Analysis

Salt is an infrastructure automation platform in which a central Salt master distributes configuration, state files, and other artifacts to minion agents over a file server API. The file server accepts file path parameters supplied in URLs from authenticated clients. The vulnerable endpoint fails to canonicalize and validate these path parameters before resolving them against the file server root.

An authenticated user with network access to the master can submit a URL containing traversal sequences such as ../ to walk outside of the intended file roots. Because the request executes with the privileges of the Salt master process — typically root — any file the master can read becomes accessible. Sensitive targets include /etc/salt/master, /etc/salt/pki/master/master.pem, pillar data, and system files such as /etc/shadow.

The attack requires low privileges and no user interaction, and it executes over the network with a scope change (the master exposes data belonging to other tenants and minions). The impact is limited to confidentiality; integrity and availability are not directly affected.

Root Cause

The root cause is improper input validation in the file server request handler. Path components supplied by the client are concatenated with the file server root without normalization, allowing .. segments to resolve above the intended directory. Standard defenses such as os.path.realpath() verification against an allow-listed base directory are not applied.

Attack Vector

Exploitation requires authenticated access to the Salt master API. The attacker issues a request that includes traversal sequences in the file path parameter. The master resolves the path, opens the target file, and returns its contents in the response body. Repeated requests enumerate the filesystem and exfiltrate secrets that can facilitate lateral movement into managed minions.

No verified proof-of-concept has been published. Refer to the Salt Project Security Advisory for vendor-supplied technical detail.

Detection Methods for CVE-2024-22232

Indicators of Compromise

File server access log entries containing .., URL-encoded traversal sequences (%2e%2e%2f, %2e%2e/), or absolute paths outside configured file roots.
Unexpected reads of sensitive files such as /etc/salt/master, /etc/salt/pki/master/master.pem, /etc/shadow, or SSH private keys by the Salt master process.
Authenticated Salt API sessions issuing high volumes of cp.get_file or file server URL requests referencing unusual paths.

Detection Strategies

Parse Salt master logs (/var/log/salt/master) for file server requests containing traversal patterns or paths that do not begin with a configured file_roots entry.
Deploy a network signature on the reverse proxy or WAF fronting the Salt API that flags URL paths containing ../, ..\, or their encoded variants.
Correlate authenticated Salt user sessions with anomalous file access patterns across the master filesystem.

Monitoring Recommendations

Forward Salt master logs and host telemetry into a centralized SIEM for retention and correlation with authentication events.
Enable filesystem auditing (auditd) on the Salt master for reads of pillar directories, PKI material, and OS credential files.
Alert on any Salt file server response returning content from paths outside the configured file_roots.

How to Mitigate CVE-2024-22232

Immediate Actions Required

Upgrade the Salt master to a patched release identified in the Salt Project Security Advisory.
Restrict network access to the Salt master API and file server ports (default 4505/4506 and the salt-api port) to trusted management networks only.
Rotate credentials, API tokens, and PKI material stored on the master if exploitation is suspected.

Patch Information

The Salt Project has released updated Salt master packages that add path normalization and enforcement of the configured file_roots boundary. Consult the Salt Project Security Advisory for the specific fixed versions applicable to your deployment channel and apply them across all Salt masters, including syndic masters.

Workarounds

Restrict Salt API authentication to a minimal set of accounts and remove any unused external_auth users until patching is complete.
Place the Salt API behind an authenticating reverse proxy that rejects URLs containing .., %2e%2e, or absolute path prefixes.
Run the Salt master under a dedicated, least-privileged user where operationally feasible to limit the scope of readable files.

bash

# Example reverse proxy rule (nginx) blocking traversal sequences
location /file/ {
    if ($request_uri ~* "(\.\./|\.\.%2f|%2e%2e/|%2e%2e%2f)") {
        return 400;
    }
    proxy_pass http://salt-api-backend;
}