CVE-2020-11652: SaltStack Salt Path Traversal Vulnerability

CVE-2020-11652 is a path traversal vulnerability in SaltStack Salt, specifically in the salt-master process component known as ClearFuncs. It can allow authenticated users to gain unintended directory access on systems running the affected software. This matters because Salt is commonly used for configuration management and remote execution across infrastructure; improper access to directories on the master can expose sensitive files or configuration data and undermine the trust boundary between operators and the control plane. CISA notes that Salt users who follow fundamental internet security guidelines and best practices are not affected.

How it works

The weakness is classified as CWE-22, improper limitation of a pathname to a restricted directory (path traversal). In this case the flaw resides in ClearFuncs within the salt-master process. An authenticated user who can interact with the vulnerable functionality may supply crafted path elements that escape the intended directory scope, thereby obtaining access to locations outside the expected workspace.

Exact request formats, parameters, and preconditions are not detailed in the provided facts; defenders should treat this as a classic authenticated path-traversal issue against the master and confirm precise mechanics and any authentication or authorization requirements against the vendor advisory. Because the attack requires authentication, exposure is limited compared with unauthenticated remote flaws, yet any compromise of credentials or overly broad access to the Salt API or master still elevates risk.

Am I affected? How to find it in your systems

SaltStack Salt typically runs as a master/minion architecture used for orchestration, configuration management, and remote command execution. The salt-master service is the critical component named in the vulnerability description. Inventory every host that runs the salt-master process, including development, staging, and any secondary or failover masters.

• Enumerate packages and services: search package managers, container images, and configuration-management inventories for Salt installations and identify which nodes act as masters.
• Record the installed Salt version and edition on each master; compare those versions directly with the fixed releases listed in the vendor advisory. Do not rely on assumed version ranges.
• Review network exposure: determine whether the master is reachable only from trusted management networks or is accessible more broadly. CISA states that environments following fundamental internet security guidelines and best practices are not affected.
• Check authentication and authorization posture: identify who can authenticate to the master and what ClearFuncs-related interfaces they can reach.
• Telemetry and logs: look for unusual authenticated sessions that attempt file or directory operations outside normal Salt file-root or cache paths, unexpected path strings containing traversal sequences, or anomalous access to system directories from the salt-master process. Correlate with authentication logs to identify the responsible identity.

Any concrete indicators of compromise or version applicability must be validated against the vendor advisory and your own baseline configurations.

How to remediate

Patch first. Apply the updates published by the vendor for SaltStack Salt exactly as instructed in the official advisory. CISA’s required action is to apply updates per vendor instructions. After patching, restart the salt-master service according to vendor guidance and verify the running version matches the remediated release.

Beyond the patch, harden the deployment for this class of weakness:

• Restrict which authenticated identities can invoke ClearFuncs or equivalent master-side file operations; enforce least privilege and strong authentication.
• Ensure Salt file roots, pillar roots, and cache directories are tightly scoped and that the master process runs with minimal filesystem privileges.
• Keep the master off the public internet and reachable only from controlled management networks, consistent with the best-practice posture CISA highlights.
• Re-validate configuration after the upgrade to confirm no residual path-handling settings remain overly permissive.

If you can't patch immediately

Until the vendor update can be applied, reduce risk with compensating controls:

• Network segmentation: isolate the salt-master so only authorized administrators and minions can reach it; block unnecessary inbound access at firewalls or security groups.
• Disable or restrict the affected functionality if operationally feasible; limit ClearFuncs exposure or related APIs to the smallest set of accounts.
• Virtual patching / reverse-proxy controls: if a web or API front-end sits in front of Salt interfaces, apply rules that reject path-traversal patterns, while recognizing that such filters are imperfect and must be tuned carefully.
• Intensified monitoring: alert on authenticated sessions performing unexpected directory listings or file reads, and on any salt-master process access outside its normal working directories. Retain authentication and command logs for investigation.
• Credential hygiene: rotate keys and credentials for accounts that can authenticate to the master, and review recent access for anomalies.

These measures buy time but do not replace the vendor patch.

If your data may have been exposed

Actively exploited vulnerabilities can lead to unauthorized access and data exposure. Known ransomware use is not documented for this CVE. If you suspect compromise, preserve logs, isolate affected masters, rotate credentials, and follow your incident-response process. You can run a free exposure scan of your email addresses to check whether they appear in known breach data sets and take further account-protection steps as needed.