Skip to main content

Incorrect Permission Assignment for Critical Resource

CVE-2022-22941

High
8.8/10

Summary

An issue was discovered in SaltStack Salt and Salt-ssh in versions prior to 3002.8, 3003.x prior to 3003.4, and 3004.x prior to 3004.1. When configured as a Master-of-Masters, with a "publisher_acl", if a user configured in the "publisher_acl" targets any minion connected to the Syndic, the Salt Master incorrectly interpreted no valid targets as valid, allowing configured users to target any of the minions connected to the syndic with their configured commands. This requires a syndic master combined with "publisher_acl" configured on the Master-of-Masters, allowing users specified in the "publisher_acl" to bypass permissions, publishing authorized commands to any configured minion.

  • LOW
  • NETWORK
  • HIGH
  • UNCHANGED
  • NONE
  • LOW
  • HIGH
  • HIGH

CWE-732 - Incorrect Permission Assignment for Critical Resource

The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

References

Advisory Timeline

  • Published