SaltStack (Salt) is a configuration management and remote execution engine managing servers at scale. Its security history includes some of the most severe infrastructure vulnerabilities disclosed: CVE-2020-11651 (CVSS 9.8) allows unauthenticated network access to the Salt master's ClearFuncs class, bypassing authentication to invoke any Salt function and execute commands on all connected minions — giving attackers root across every managed server without a single credential; CVE-2020-11652 (CVSS 9.1) exploits a directory traversal in the Salt master's wheel file_roots function to read arbitrary files; salt-api with rest_cherrypy exposes an HTTP API that, when combined with weak eAuth configuration or the runner module, allows command execution via runner.cmd_run; minions in older Salt versions accepted commands from any master without verifying the master's public key; and Salt's use of ZeroMQ on ports 4505-4506 is often exposed on internal networks without TLS, allowing message interception. This guide covers systematic Salt security assessment.
# SaltStack default ports:
# 4505 — ZeroMQ publish port (master to minion broadcasts)
# 4506 — ZeroMQ return port (minion to master responses)
# 8000 — salt-api HTTP endpoint (if enabled)
# Detect Salt master
nmap -sV -p 4505,4506,8000 salt-master.example.com 2>/dev/null | grep -E "(open|Service)" | head -8
# Identify ZeroMQ service (Salt exposes no banner by default)
nc -z -w 3 salt-master.example.com 4505 2>/dev/null && echo "Port 4505 open (ZeroMQ publisher)"
nc -z -w 3 salt-master.example.com 4506 2>/dev/null && echo "Port 4506 open (ZeroMQ return)"
# Check salt-api HTTP endpoint
curl -s -o /dev/null -w "%{http_code}" \
http://salt-master.example.com:8000/login 2>/dev/null
# 200 = salt-api is running, authentication form available# CVE-2020-11651: Salt master exposes two message server classes:
# - CryptoFuncs: requires authentication (normal path)
# - ClearFuncs: intended for internal use, accessible without authentication
# The vulnerability allows external clients to invoke ClearFuncs methods directly
# PoC: Python script to test CVE-2020-11651 (educational reference)
# Requires: pip install salt (or use salt-checker tool)
# Using the public proof-of-concept (educational/authorized testing only):
# git clone https://github.com/chef-cve/salt-cve-2020-11651-poc
# python3 poc.py --master salt-master.example.com
# What CVE-2020-11651 allows without authentication:
# 1. Get the root key from the master (used to bypass CryptoFuncs auth)
# 2. Call any Salt function as root on all connected minions
# 3. cmd.run 'id' on all minions — confirms full RCE
# Simplified flow (authorized testing only):
# salt-checker -host salt-master.example.com -port 4506 -cmd "id"
# Returns: {'minion1': 'uid=0(root)', 'minion2': 'uid=0(root)', ...}
# Verify if instance is patched: Salt >= 2019.2.4 and >= 3000.2 are patched
# Run on master (if access available): salt --version | grep -E "^[Ss]alt"runner.cmd_run is effectively unrestricted shell execution on the master.* as a permitted function for any user| Security Test | Method | Risk |
|---|---|---|
| CVE-2020-11651 unauthenticated RCE via ClearFuncs | Python PoC targeting port 4506 — root key extraction and cmd.run on all minions without auth | Critical |
| CVE-2020-11652 directory traversal | Wheel file_roots path traversal — read /etc/shadow or SSH keys from master filesystem | Critical |
| salt-api runner.cmd_run via weak eAuth | POST /login with eAuth credentials; POST /run with client=runner fun=cmd.run arg="id" | Critical |
| ZeroMQ ports exposed to internet | nmap -p 4505,4506 — if open from external IP, CVE-2020-11651 is directly exploitable | Critical |
| salt-api accessible over HTTP (no TLS) | curl http://host:8000/login — credentials transmitted in cleartext | High |
| Minion accepts commands from any master | Set up rogue Salt master; attempt to send commands to unprotected minions | High |
Ironimo tests SaltStack deployments for CVE-2020-11651 unauthenticated ClearFuncs authentication bypass allowing root command execution on all minions, CVE-2020-11652 directory traversal reading arbitrary files from the Salt master, salt-api runner module exposure enabling shell execution via weak eAuth configuration, ZeroMQ ports 4505/4506 accessible from unauthorized networks, salt-api operating over unencrypted HTTP, and overly permissive eAuth ACL configurations.
Start free scan