CVE-2020-28243
HIGHSaltStack Salt < 3002.5 - Command Injection via Crafted Process Name
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2020-28243. PoCs published by stealthcopter.
AI-analyzed exploit summary This repository contains a functional exploit for CVE-2020-28243, a command injection vulnerability in SaltStack Salt. The exploit leverages a specially crafted process name and file descriptor to achieve local privilege escalation when the master calls restartcheck.
Description
An issue was discovered in SaltStack Salt before 3002.5. The minion's restartcheck is vulnerable to command injection via a crafted process name. This allows for a local privilege escalation by any user able to create a files on the minion in a non-blacklisted directory.
Exploits (1)
This repository contains a functional exploit for CVE-2020-28243, a command injection vulnerability in SaltStack Salt. The exploit leverages a specially crafted process name and file descriptor to achieve local privilege escalation when the master calls restartcheck.
References (11)
Scores
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H