Command Injection Flaw in SaltStack Salt Affects Local Privilege Escalation
CVE-2020-28243
7.8HIGH
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2020-28243?
A significant vulnerability has been identified in SaltStack Salt that allows users to exploit a command injection flaw through crafted process names. This weakness impacts all versions released prior to 3002.5, enabling a malicious actor with the ability to create files in non-blacklisted directories on the minion to escalate their privileges locally. This vulnerability underlines the necessity for careful management of user permissions and prompt updates to secure systems against potential exploits.
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.