CVE-2020-16846
Published: 06 November 2020
Summary
CVE-2020-16846 is a critical-severity OS Command Injection (CWE-78) vulnerability in Saltstack Salt. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 0.0% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Deeper analysis
The vulnerability CVE-2020-16846 is a shell injection flaw, tracked under CWE-78, that affects SaltStack Salt through version 3002. It resides in the Salt API component when the SSH client is enabled and carries a CVSS 3.1 base score of 9.8 reflecting network-accessible, unauthenticated attack conditions.
An unauthenticated remote attacker can exploit the issue by submitting crafted web requests to the Salt API, resulting in arbitrary command execution that yields full control over confidentiality, integrity, and availability of the affected system.
Public advisories reference patches and updated packages distributed via the SaltStack GitHub releases along with downstream fixes from openSUSE and Debian LTS. No information on observed in-the-wild exploitation is supplied in the source data.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2020-0173
Vulnerability details
An issue was discovered in SaltStack Salt through 3002. Sending crafted web requests to the Salt API, with the SSH client enabled, can result in shell injection.
- CWE(s)
- KEV Date Added
- 03 November 2021
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of all inputs to the Salt API to block crafted requests that trigger shell injection.
Enforces authentication and authorization on the Salt API before any SSH-related commands can be processed.
Requires explicit authorization and secure configuration for all remote access paths to the Salt API.