Vulnerability record · CVE-2020-11652 · published 30 April 2020
CVE-2020-11652: SaltStack Salt master path traversal in ClearFuncs methods
Saltstack · Salt
SaltStack Salt before 2019.2.4 and 3000 before 3000.2 has a path traversal flaw in the salt-master ClearFuncs class, where several methods fail to properly sanitize paths. An authenticated user can reach directories outside the intended scope, exposing files on the master host. It matters because the master is a high-value control point and the flaw is listed in CISA KEV with a very high EPSS score.
Description
An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class allows access to some methods that improperly sanitize paths. These methods allow arbitrary directory access to authenticated users.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Automated analysis
high priorityIt is in CISA KEV with a very high EPSS score and enables sensitive file disclosure on a central management host, though it requires authenticated access and only affects confidentiality.
What it is
SaltStack Salt before 2019.2.4 and 3000 before 3000.2 has a path traversal flaw in the salt-master ClearFuncs class, where several methods fail to properly sanitize paths. An authenticated user can reach directories outside the intended scope, exposing files on the master host. It matters because the master is a high-value control point and the flaw is listed in CISA KEV with a very high EPSS score.
Impact
An attacker with valid credentials gains arbitrary directory read access on the salt-master, allowing theft of configuration, keys and other sensitive files. The CVSS vector shows high confidentiality impact only, with no integrity or availability effect.
Attack surface
Reachable over the network against the salt-master service (AV:N) with low privileges required (PR:L) and no user interaction (UI:N). Authentication is needed, so an existing low-privileged account or key is a prerequisite.
Exploitation
CVE-2020-11652 is in CISA KEV (added 2021-11-03) and has an EPSS 30-day probability of 0.86178 (99.72nd percentile), indicating active exploitation. Reference tags include an Exploit entry on Packet Storm, though the record does not state whether that exploit targets this CVE specifically.
What to do
- Upgrade Salt to 2019.2.4 or 3000.2 or later, or apply the vendor and distribution updates (Debian DSA-4676, Ubuntu USN-4459-1, openSUSE advisories).
- Restrict network access to the salt-master service to trusted management hosts only.
- Review and minimize accounts and keys that can authenticate to the master, and rotate credentials if compromise is suspected.
- Monitor vendor advisories for the related Salt master/minion issues patched in the same releases.
Detection
- Audit salt-master logs for ClearFuncs method calls with unusual or traversal-style path arguments.
- Alert on file reads by the salt-master process outside expected Salt directories.
- Hunt for unexpected outbound connections or file exfiltration from master hosts.
- Correlate authentication events to the master with subsequent abnormal file access.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2020-11652 to the Known Exploited Vulnerabilities catalog on 3 November 2021 as "SaltStack Salt Path Traversal Vulnerability". Required action: Apply updates per vendor instructions. Federal deadline 3 May 2022.
Affected products
6 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2020-11652 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2020-11652), CISA KEV, FIRST EPSS (scores of 2026-09-24). This page is refreshed as NVD updates the record.
