SaltStack Salt Unauthenticated Remote Code Execution (RCE) Vulnerability Analysis (CVE-2020-11651)

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2020-11651) is a critical authentication bypass and remote code execution (RCE) flaw within the salt-master process of SaltStack Salt. The salt-master utilizes ZeroMQ to communicate with its minions, where the ClearFuncs class is designed to handle unauthenticated requests. However, a severe design flaw exists where the ClearFuncs class fails to properly validate and restrict method calls, allowing remote unauthenticated users to invoke sensitive internal methods directly.

2. Exploitation Mechanics & Attack Scenario

An attacker can exploit this vulnerability by sending specially crafted ZeroMQ messages to the salt-master control port (typically port 4506). Because the ClearFuncs class processes these messages without verifying authorization, the attacker can:

• Call the _prep_auth_info() method to retrieve the master's local user tokens and the root key.
• Leverage the retrieved root key to call the _send_pub() method, which publishes arbitrary shell commands to all connected salt-minion instances to be executed with root privileges.

This process requires no user interaction or valid credentials, making it highly susceptible to automated exploitation.

3. Infrastructure & Business Impact

With a CVSS score of 9.8 and its inclusion in the CISA KEV catalog, this vulnerability represents an extreme risk to enterprise environments. Successful exploitation grants the attacker complete administrative control over the entire infrastructure managed by the compromised Salt master. This can lead to widespread ransomware deployment, data exfiltration, unauthorized resource utilization (e.g., cryptomining), and lateral movement across internal networks.