An issue was discovered in SaltStack Salt before 3003.3. The salt minion installer will accept and use a minion config file at C:\salt\conf if that file is in place before the installer is run. This allows for a malicious actor to subvert the proper behaviour of the given minion software.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An issue was discovered in SaltStack Salt before 3003.3. The salt minion installer will accept and use a     minion config file at C:\salt\conf if that file is in place before the installer is run. This allows for a     malicious actor to subvert the proper behaviour of the given minion software. (CVE-2021-22004)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - An issue was discovered in SaltStack Salt before 3003.3. The salt minion installer will accept and use a
    minion config file at C:\salt\conf if that file is in place before the installer is run. This allows for a
    malicious actor to subvert the proper behaviour of the given minion software. (CVE-2021-22004)

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - An issue was discovered in SaltStack Salt before 3003.3. A user who has control of the source, and
    source_hash URLs can gain full file system access as root on a salt minion. (CVE-2021-21996)

  - An issue was discovered in SaltStack Salt before 3003.3. The salt minion installer will accept and use a
    minion config file at C:\salt\conf if that file is in place before the installer is run. This allows for a
    malicious actor to subvert the proper behaviour of the given minion software. (CVE-2021-22004)

The remote Fedora 33 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-93a7c8b7c6 advisory.

  - An issue was discovered in SaltStack Salt before 3003.3. A user who has control of the source, and     source_hash URLs can gain full file system access as root on a salt minion. (CVE-2021-21996)

  - An issue was discovered in SaltStack Salt before 3003.3. The salt minion installer will accept and use a     minion config file at C:\salt\conf if that file is in place before the installer is run. This allows for a     malicious actor to subvert the proper behaviour of the given minion software. (CVE-2021-22004)

  - In SaltStack Salt 2016.9 through 3002.6, a command injection vulnerability exists in the snapper module     that allows for local privilege escalation on a minion. The attack requires that a file is created with a     pathname that is backed up by snapper, and that the master calls the snapper.diff function (which executes     popen unsafely). (CVE-2021-31607)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 34 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-00ada7e667 advisory.

  - An issue was discovered in SaltStack Salt before 3003.3. A user who has control of the source, and     source_hash URLs can gain full file system access as root on a salt minion. (CVE-2021-21996)

  - An issue was discovered in SaltStack Salt before 3003.3. The salt minion installer will accept and use a     minion config file at C:\salt\conf if that file is in place before the installer is run. This allows for a     malicious actor to subvert the proper behaviour of the given minion software. (CVE-2021-22004)

  - In SaltStack Salt 2016.9 through 3002.6, a command injection vulnerability exists in the snapper module     that allows for local privilege escalation on a minion. The attack requires that a file is created with a     pathname that is backed up by snapper, and that the master calls the snapper.diff function (which executes     popen unsafely). (CVE-2021-31607)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
261082	Linux Distros Unpatched Vulnerability : CVE-2021-22004	Nessus	Misc.	medium
420446	SCA: security update for salt (GHSA-xf37-qcvf-7m57)	Tenable Cloud Security	SCA Checks	high
420446	SCA: security update for salt (GHSA-xf37-qcvf-7m57)	Tenable Self-Hosted Container Security	SCA Checks	high
407046	Alpine: multiple salt packages: security update to 3003.3-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
407046	Alpine: multiple salt packages: security update to 3003.3-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
153200	Fedora 33 : salt (2021-93a7c8b7c6)	Nessus	Fedora Local Security Checks	high
153199	Fedora 34 : salt (2021-00ada7e667)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2021-22004

high

Tenable Plugins

medium

high

high

high

high

high

high