CVE-2021-25281
CRITICAL EXPLOITED NUCLEISaltStack Salt < 3002.5 - Unauthenticated Remote Command Execution via wheel_async Client
Title source: llmExploitation Summary
CVE-2021-25281 has been observed exploited in the wild (reported by VulnCheck KEV).
EIP tracks 2 public exploits from researchers including Immersive-Labs-Sec, Alex Seymour, Christophe De La Fuente, including a Metasploit module exploits/linux/http/saltstack_salt_wheel_async_rce.
A Nuclei detection template is also available.
AI-analyzed exploit summary This repository contains a functional exploit for CVE-2021-25281, which leverages directory traversal in SaltStack's file writing functionality to achieve arbitrary file write and potential remote code execution. The exploit includes multiple modes for writing files, creating state files for command execution, and injecting SSH keys.
Description
An issue was discovered in through SaltStack Salt before 3002.5. salt-api does not honor eauth credentials for the wheel_async client. Thus, an attacker can remotely run any wheel modules on the master.
Exploits (2)
This repository contains a functional exploit for CVE-2021-25281, which leverages directory traversal in SaltStack's file writing functionality to achieve arbitrary file write and potential remote code execution. The exploit includes multiple modes for writing files, creating state files for command execution, and injecting SSH keys.
This Metasploit module exploits an authentication bypass (CVE-2021-25281) and directory traversal (CVE-2021-25282) in SaltStack Salt's REST API to achieve unauthenticated remote code execution as root. It leverages the maintenance process check to execute a malicious Python script placed in the Extension Module directory.
Nuclei Templates (1)
References (11)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H