CVE-2021-25281 PoC — Saltstack SaltStack Salt 授权问题漏洞

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-25281.yaml

Associated Vulnerability

Title:Saltstack SaltStack Salt 授权问题漏洞 (CVE-2021-25281)
Description:Saltstack SaltStack Salt是SaltStack（Saltstack）公司的一套开源的用于管理基础架构的工具。该工具提供配置管理、远程执行等功能。 SaltStack Salt before 3002.5 存在安全漏洞，该漏洞源于salt-api不支持eauth凭据。攻击者可利用该漏洞可以远程运行主机上的任何模块。

Description

SaltStack Salt before 3002.5 does not honor eauth credentials for the wheel_async client, allowing attackers to remotely run any wheel modules on the master.

File Snapshot


 id: CVE-2021-25281

info:
  name: SaltStack Salt <3002.5 - Auth Bypass
  author: madrobot
  severity

...

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!