CVE-2020-28243

HIGH

SaltStack Salt < 3002.5 - Command Injection via Crafted Process Name

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2020-28243. PoCs published by stealthcopter.

AI-analyzed exploit summary This repository contains a functional exploit for CVE-2020-28243, a command injection vulnerability in SaltStack Salt. The exploit leverages a specially crafted process name and file descriptor to achieve local privilege escalation when the master calls restartcheck.

Description

An issue was discovered in SaltStack Salt before 3002.5. The minion's restartcheck is vulnerable to command injection via a crafted process name. This allows for a local privilege escalation by any user able to create a files on the minion in a non-blacklisted directory.

Exploits (1)

nomisec WORKING POC 18 stars
by stealthcopter · poc
https://github.com/stealthcopter/CVE-2020-28243

This repository contains a functional exploit for CVE-2020-28243, a command injection vulnerability in SaltStack Salt. The exploit leverages a specially crafted process name and file descriptor to achieve local privilege escalation when the master calls restartcheck.

Classification
Working Poc 100%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: SaltStack Salt (versions 2016.3.0rc2 to 3002.5)
No auth needed
Prerequisites: Write/Exec access to a directory not ignored by SaltStack · Master must call restartcheck.restartcheck on the minion
devstral-2 · analyzed Feb 16, 2026 Full analysis →

Scores

CVSS v3 7.8
EPSS 0.0141
EPSS Percentile 81.0%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-77
Status published
Products (8)
debian/debian_linux 9.0
debian/debian_linux 10.0
debian/debian_linux 11.0
fedoraproject/fedora 32
fedoraproject/fedora 33
fedoraproject/fedora 34
pypi/salt 0 - 2015.8.13PyPI
saltstack/salt < 2015.8.10
Published Feb 27, 2021
Tracked Since Feb 18, 2026