SaltStack Salt-Master ClearFuncs Directory Traversal Vulnerability (CVE-2020-11652) Analysis and Mitigation Guide
Executive & SecOps Summary
SECOPS ASSESSMENTSaltStack Salt versions before 2019.2.4 and 3000 before 3000.2
Authenticated users can access arbitrary directories and retrieve sensitive files via improperly sanitized paths in the ClearFuncs class of the salt-master process
Immediately upgrade SaltStack to the latest stable versions (2019.2.4, 3000.2 or higher) and restrict access to master ports (4505, 4506)
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Update the Salt packages to the latest secured versions using your operating system's package manager.
# For Debian/Ubuntu systems
sudo apt-get update
sudo apt-get install --only-upgrade salt-master salt-minion -y
# For RHEL/CentOS systems
sudo yum update salt-master salt-minion -y
# Verify the installed version
salt-master --version2. Temporary Workaround & Hardening Configuration
If immediate patching is not feasible, restrict access to the salt-master ports (4505 and 4506) using firewall rules to allow only trusted Minion IPs.
# Set default deny policy (using UFW)
sudo ufw default deny incoming
# Allow access to ports 4505 and 4506 only from a trusted Minion IP (e.g., 192.168.1.100)
sudo ufw allow from 192.168.1.100 to any port 4505 proto tcp
sudo ufw allow from 192.168.1.100 to any port 4506 proto tcp
sudo ufw reload3. Log Audit & IoC Verification Commands
Audit the salt-master logs to detect potential directory traversal attempts or anomalous ClearFuncs calls.
# Search for suspicious ClearFuncs calls and directory traversal patterns in logs
grep -E 'ClearFuncs|\.\./' /var/log/salt/master
# Verify active listening ports for salt-master
ss -tulpn | grep -E '4505|4506'Detect Container Escape & Privilege Escalation Across Your Kubernetes Fleet
Continuous eBPF-based runtime threat detection and posture management for AWS, GCP, Azure, Docker, and Kubernetes workloads.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2020-11652) exists within the ClearFuncs class of the salt-master process in SaltStack Salt. The ClearFuncs class handles unauthenticated or authenticated control messages. Due to a lack of proper path sanitization in certain methods within this class, an attacker can perform directory traversal attacks by injecting directory traversal sequences (e.g., ../) into file path parameters.
2. Exploitation Mechanics & Attack Scenario
An attacker can craft malicious ZeroMQ messages and send them directly to the salt-master request server port (default 4506). By invoking the vulnerable methods exposed by the ClearFuncs class and supplying a manipulated path such as ../../../../etc/passwd, the attacker forces the master process (which typically runs with root privileges) to read and return arbitrary files from the local filesystem. This vulnerability is often chained with CVE-2020-11651 to achieve full remote code execution and infrastructure compromise.
3. Infrastructure & Business Impact
As a CISA KEV-listed vulnerability, this flaw has been actively exploited in the wild by threat actors. Successful exploitation allows unauthorized access to critical configuration files, private keys, and credentials stored on the Salt-master. This compromises the entire managed infrastructure, potentially leading to widespread data breaches and supply chain compromise.
Official Vendor Advisories & References
An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class allows access to some methods that improperly sanitize paths. These methods allow arbitrary directory access to authenticated users.
Frequently Asked SecOps Questions (CVE-2020-11652)
FAQQ1. How critical is CVE-2020-11652 and is it actively exploited in the wild?
CVE-2020-11652 is rated CVSS 6.5 (MEDIUM) with a 30-day EPSS exploitation probability of 86.5%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2020-11652?
Primary impacted vendors include saltstack across salt. Scope summary: SaltStack Salt versions prior to 2019.2.4 and 3000 prior to 3000.2
Q3. What temporary mitigations or workarounds exist for CVE-2020-11652 before patching?
[Mitigation] Immediately upgrade SaltStack to the latest stable versions (2019.2.4, 3000.2 or higher) and restrict access to master ports (4505, 4506) Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2020-11652
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (saltstack)
View Category →Kestra Orchestration Platform Authentication Bypass and Remote Code Execution (RCE) Vulnerability (CVE-2026-49869)
[Affected Scope] Kestra open-source versions prior to 1.0.45 and 1.3.21
MLflow Webhook Test Endpoint Server-Side Request Forgery (SSRF) Vulnerability (CVE-2026-64849)
[Affected Scope] MLflow versions from 3.3.0 prior to 3.15.0
VMware ESX Insufficient Logging Vulnerability (CVE-2026-41709) - Audit Bypass and Admin Activity Concealment
[Affected Scope] VMware ESX hypervisor environments.
GitLab CE/EE Unauthenticated Arbitrary File Read Vulnerability (CVE-2026-85706)
[Affected Scope] GitLab CE/EE versions from 18.7 through 19.3.1.
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.