Any user could become root, warns Immersive Labs researcher
Gareth Corfield
Wed 3 Mar 2021 // 16:47 UTC
Share
Copy
Proof of concept code has been published for a vulnerability in popular data centre security management tool Saltstack, which was discovered after a developer at Immersive Labs found a privilege escalation bug allowing any old user to become root.
SaltStack offers open-source, Python-based automation tools and was acquired by VMware in October last year.
Salt and pepper
Last year Salt patched two CVEs – CVE-2020-11651 and CVE-2020-11652 – after researchers from F-Secure spotted an authentication bypass and a directory traversal vuln, both of which were patched at the time. Famously, the combo exposed those with Salt installations to complete control by an attacker.