CVE-2025-62348: Salt Junos Module RCE Vulnerability

CVE-2025-62348 Overview

Salt's junos execution module contained an unsafe YAML decode/load usage vulnerability (CWE-94: Code Injection). A specially crafted YAML payload processed by the junos module could lead to unintended code execution under the context of the Salt process. This vulnerability allows attackers with local access to potentially execute arbitrary code by exploiting the unsafe deserialization of YAML content.

Critical Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code in the context of the Salt process, potentially leading to complete system compromise, data theft, or lateral movement within infrastructure managed by Salt.

Affected Products

• Salt Project (junos execution module)
• Salt versions prior to 3006.17

Discovery Timeline

• 2026-01-30 - CVE CVE-2025-62348 published to NVD
• 2026-02-04 - Last updated in NVD database

Technical Details for CVE-2025-62348

Vulnerability Analysis

This vulnerability stems from unsafe YAML deserialization practices within Salt's junos execution module. YAML deserialization vulnerabilities occur when applications use unsafe loading functions that can instantiate arbitrary Python objects from YAML input. In Python, the yaml.load() function without a safe loader (such as yaml.safe_load()) can deserialize malicious YAML payloads that include Python object constructors, enabling attackers to execute arbitrary code.

The junos execution module in Salt processes YAML data, and due to the unsafe decode/load usage, specially crafted YAML payloads can trigger code execution. This is particularly dangerous in Salt environments where the Salt master or minions process configuration data, as an attacker who can influence the YAML content being processed could leverage this to gain code execution privileges.

Root Cause

The root cause of this vulnerability is the use of unsafe YAML loading functions within Salt's junos execution module. When YAML content is loaded using Python's yaml.load() without specifying a safe loader, the parser can instantiate arbitrary Python objects through YAML's object serialization features. Attackers can craft YAML documents containing malicious object constructors (such as !!python/object/apply:os.system) that execute arbitrary commands when deserialized.

Attack Vector

This vulnerability has a local attack vector, requiring the attacker to have some level of local access or the ability to influence YAML content processed by the junos module. The attack flow typically involves:

1. An attacker crafts a malicious YAML payload containing embedded Python object constructors
2. The payload is introduced to the Salt junos module through a configuration file, API call, or other input mechanism
3. When the junos module processes the YAML content using the unsafe loader, the malicious objects are instantiated
4. Code execution occurs within the context of the Salt process, which typically runs with elevated privileges

The vulnerability does not require user interaction and can be exploited with low privileges, though some preparation (AT:P) is required to successfully trigger the condition.

Detection Methods for CVE-2025-62348

Indicators of Compromise

• Unexpected process spawning from Salt master or minion processes
• Anomalous YAML files containing !!python/object, !!python/apply, or similar YAML tags in Salt configuration directories
• Unusual network connections or file system activity originating from Salt processes
• Log entries indicating YAML parsing errors followed by unexpected system behavior

Detection Strategies

• Monitor Salt process activity for unexpected child processes or command executions
• Implement file integrity monitoring on Salt configuration directories to detect modified or malicious YAML files
• Configure SIEM rules to alert on suspicious YAML constructs in Salt-related logs
• Deploy endpoint detection solutions to monitor Salt process behavior for code injection patterns

Monitoring Recommendations

• Enable verbose logging for Salt master and minion processes to capture YAML processing events
• Monitor for process injection or unusual memory allocation patterns in Salt processes
• Implement network monitoring to detect unexpected outbound connections from Salt infrastructure
• Regularly audit Salt configuration files for unexpected or suspicious YAML content

How to Mitigate CVE-2025-62348

Immediate Actions Required

• Upgrade Salt to version 3006.17 or later immediately
• Review and audit any custom Salt modules that process YAML content for similar unsafe loading patterns
• Implement strict access controls to limit who can modify Salt configuration files
• Consider temporarily disabling the junos execution module if not actively needed until patching is complete

Patch Information

The Salt Project has addressed this vulnerability in release 3006.17. Organizations should upgrade to this version or later to remediate the vulnerability. Detailed release notes are available in the Salt Project Release Note.

Workarounds

• Restrict access to Salt master and minion configuration directories to trusted administrators only
• Implement input validation and sanitization for any YAML content processed by Salt modules
• Use network segmentation to limit the exposure of Salt infrastructure to untrusted sources
• Consider deploying application allowlisting to prevent unauthorized code execution from Salt processes

# Upgrade Salt to patched version
pip install --upgrade salt>=3006.17

# Alternatively, using package manager on RHEL/CentOS
yum update salt-master salt-minion

# Or on Debian/Ubuntu
apt-get update && apt-get upgrade salt-master salt-minion