{"componentChunkName":"component---src-templates-post-js","path":"/resources/blog/saltstack-further-injection-vulnerabilities/","result":{"data":{"wordpress":{"post":{"id":"cG9zdDoxNTY4Ng==","title":"SaltStack: further injection vulnerabilities","slug":"saltstack-further-injection-vulnerabilities","date":"2021-03-24T08:17:25","modifiedGmt":"2021-06-04T02:24:08","content":"\n<div class=\"wp-block-columns\">\n<div class=\"wp-block-column\" style=\"flex-basis:66.66%\">\n<p><em>In February 2021, our security researcher Mat Rollings&nbsp;<a href=\"https://www.immersivelabs.com/resources/blog/why-so-salty-local-privilege-escalation-on-saltstack-minions/\">disclosed a local privilege escalation (CVE-2020-28243)</a>&nbsp;in&nbsp;<a href=\"https://github.com/saltstack/salt\">SaltStack&#8217;s Salt</a>&nbsp;via specially crafted process names. However, while the initial fix SaltStack published did prevent command injection, it wasn’t enough; it didn’t prevent argument injection. This second vulnerability was much less severe than the original CVE, but still could have caused a low-impact denial of service.</em></p>\n\n\n\n<h2>The SaltStack fix</h2>\n\n\n\n<p>Let&#8217;s start by understanding the first fix SaltStack released in an attempt to sanitize the package names to prevent the command injection. To do this, we can look at the difference between the two versions of code, available as a <a href=\"https://gitlab.com/saltstack/open/salt-patches/-/blob/master/patches/2021/01/28/3002.2.patch#L1414\">diff</a>.</p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img loading=\"lazy\" width=\"732\" height=\"372\" src=\"https://cms.immersivelabs.com/content/uploads/2021/03/image-3.png\" alt=\"\" class=\"wp-image-15690\" srcset=\"https://cms.immersivelabs.com/content/uploads/2021/03/image-3.png 732w, https://cms.immersivelabs.com/content/uploads/2021/03/image-3-300x152.png 300w\" sizes=\"(max-width: 732px) 100vw, 732px\" /><figcaption><em>SaltStack’s original fix for CVE-2020-28243</em></figcaption></figure></div>\n\n\n\n<p>At a first glance, this all looks good. SaltStack made the following changes:</p>\n</div>\n\n\n\n<div class=\"wp-block-column\" style=\"flex-basis:33.33%\">\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-full is-resized\"><img loading=\"lazy\" src=\"https://cms.immersivelabs.com/content/uploads/2021/02/round-1.png\" alt=\"Mat Rollings, author of SaltStack: further injection vulnerabilities\" class=\"wp-image-14651\" width=\"113\" height=\"113\" srcset=\"https://cms.immersivelabs.com/content/uploads/2021/02/round-1.png 450w, https://cms.immersivelabs.com/content/uploads/2021/02/round-1-300x300.png 300w, https://cms.immersivelabs.com/content/uploads/2021/02/round-1-150x150.png 150w\" sizes=\"(max-width: 113px) 100vw, 113px\" /></figure></div>\n\n\n\n<p class=\"has-text-align-center\"><strong>Mat Rollings, </strong><br>Senior Application Security Engineer<br>Twitter: <a rel=\"noreferrer noopener\" href=\"https://twitter.com/stealthcopter\" target=\"_blank\">@stealthcopter</a><br>Blog: <a href=\"http://sec.stealthcopter.com/\" target=\"_blank\" rel=\"noreferrer noopener\">sec.stealthcopter.com</a></p>\n</div>\n</div>\n\n\n\n<ul><li>Removal of <code>shell=True</code>, which prevents command chaining or redirection using a control character like <code>&gt;</code>, <code>||</code>, <code>&amp;&amp;</code>, or <code>;</code></li><li>Addition of <a href=\"https://docs.python.org/3/library/shlex.html\">shlex</a>, a command shell sanitizing library, in an attempt to sanitize the command</li></ul>\n\n\n\n<h2>The SaltStack error</h2>\n\n\n\n<p>The developer that added this fix made an error. Their usage of shlex does not provide any additional protection. The <code>shlex.split</code> function takes an input string and splits it into the command and its arguments using spaces as the delimiter. We control the package variable, which means we can inject additional arguments into the command.</p>\n\n\n\n<p>This advanced form of command injection is known as <strong>argument injection</strong>. Typical command injection can fail if subshells or redirection are blocked, yet argument injection can still work under the same conditions – and even when sanitization occurs.</p>\n\n\n\n<p>The screenshot below shows the <code>dpkg</code> command running with two inputs. The first is a regular package name, and the second is one that will be interpreted as an argument and cause unintended execution paths.</p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img loading=\"lazy\" width=\"726\" height=\"290\" src=\"https://cms.immersivelabs.com/content/uploads/2021/03/image-2.png\" alt=\"\" class=\"wp-image-15689\" srcset=\"https://cms.immersivelabs.com/content/uploads/2021/03/image-2.png 726w, https://cms.immersivelabs.com/content/uploads/2021/03/image-2-300x120.png 300w\" sizes=\"(max-width: 726px) 100vw, 726px\" /><figcaption><em>dpkg running with a regular package name and an unexpected argument</em></figcaption></figure></div>\n\n\n\n<p>Triggering an argument injection like this might not seem exciting at first. But it can cause crashes in poorly written applications where unexpected output is not accounted for, eventually leading to a denial of service. If we manage to directly control the output, we may be able to control the execution flow of the application, leading to further compromise.</p>\n\n\n\n<p>More advanced argument injections can achieve code execution, but these rely on finding a suitable argument to be abused. Unfortunately, none of the arguments that can be passed to the three package commands, <code>dpkg</code>, <code>repoquery</code> or <code>opkg</code>, appear to be exploitable for this purpose, so code execution does not appear possible.<br>However, we can bring about a denial of service by causing the command to hang indefinitely. A fifo file, created using the <code>mkfifo</code> command, is a file that cannot be read until it is written to. This can cause any program reading from this file to hang.</p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img loading=\"lazy\" width=\"421\" height=\"66\" src=\"https://cms.immersivelabs.com/content/uploads/2021/03/image-1.png\" alt=\"\" class=\"wp-image-15688\" srcset=\"https://cms.immersivelabs.com/content/uploads/2021/03/image-1.png 421w, https://cms.immersivelabs.com/content/uploads/2021/03/image-1-300x47.png 300w\" sizes=\"(max-width: 421px) 100vw, 421px\" /><figcaption><em>Example command that will cause a hang in dpkg-query</em></figcaption></figure></div>\n\n\n\n<p>When a custom admin directory is set, <code>dpkg-query</code> will attempt to read a file in this directory named <strong>status</strong>. As we have made a fifo file with this name in the tmp directory, the command will hang indefinitely.</p>\n\n\n\n<p>When this process hangs, both the master and minion will continue to function as normal but the process that called the restart check will hang indefinitely. As such, this exploit is pretty low in severity.</p>\n\n\n\n<h2><strong>What happened next?</strong></h2>\n\n\n\n<p><strong>Coordinated disclosure</strong> is a process of sharing the suggested solution with the reporter before it’s released publicly. The reporter can then test and propose modifications where it does not adequately fix the vulnerability. Unfortunately, SaltStack initially published the security fix without coordinated disclosure with the author. If they had communicated on the solution, the issue would have been spotted and a secondary fix wouldn’t have been necessary.</p>\n\n\n\n<p>Thankfully, the second time around SaltStack shared the fix for approval before publication. This is a step in the right direction and shows more of a proactive than reactive approach to security, which is always better in the long run.</p>\n\n\n\n<h2>The new SaltStack fix</h2>\n\n\n\n<p>The final solution SaltStack implemented avoids the need to use shlex to escape the command string as it builds an array that is passed to <code>popen</code>. This ensures that the package name can only ever be a single argument as spaces and quotes will be escaped automatically.</p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img loading=\"lazy\" width=\"709\" height=\"625\" src=\"https://cms.immersivelabs.com/content/uploads/2021/03/image-4.png\" alt=\"\" class=\"wp-image-15691\" srcset=\"https://cms.immersivelabs.com/content/uploads/2021/03/image-4.png 709w, https://cms.immersivelabs.com/content/uploads/2021/03/image-4-300x264.png 300w\" sizes=\"(max-width: 709px) 100vw, 709px\" /><figcaption><em>SaltStack’s updated fix for CVE-2020-28243</em></figcaption></figure></div>\n\n\n\n<p>A further addition was the <code>--</code> argument in each of the <code>cmd_pkg_query</code> variables. In most POSIX compatible commands, the <code>--</code> argument signifies the end of all option arguments, and all subsequent arguments are treated as string literals, even if they begin with <code>-</code> or <code>--</code>. This little-known tip is handy when passing user-controlled parameters to commands as it can protect against argument injection. For more information, check out these <a href=\"https://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap12.html#tag_12_02\">Utility Syntax Guidelines</a>.</p>\n\n\n\n<h2>Conclusion</h2>\n\n\n\n<p>The security fix for the original vulnerability was released on 4th February 2021, and the updated fix was released on the 23rd March 2021. You can find out more about <strong>CVE-2020-28243 </strong>over on the SaltStack announcement <a href=\"https://saltproject.io/security_announcements/active-saltstack-cve-release-2021-feb-25/\">here</a>.</p>\n\n\n\n<p>Fixing security vulnerabilities is a difficult task to get right, especially when the pressure is on to hit a deadline. Are you confident your web applications are secure? Immersive Labs’ series on <strong>Python Secure Coding</strong> is the best place to practice and level up your skills in identifying, exploiting, securing and validating common vulnerabilities in web applications. Log in to check this out.</p>\n\n\n\n<p>If you&#8217;re an Immersive Labs user, book a demo today for a tour of our human cyber readiness platform.</p>\n\n\n\n\n\n<p></p>\n","excerpt":"<p>The fix for CVE-2020-28243 in SaltStack may have prevented command injection – but it wasn&#8217;t enough.</p>\n","blocks":[{"__typename":"WordPress_CoreColumnsBlock","name":"core/columns","innerBlocks":[{"__typename":"WordPress_CoreColumnBlock","name":"core/column","attributes":{"__typename":"WordPress_CoreColumnBlockDeprecatedV1Attributes","width":"66.66","verticalAlignment":null},"innerBlocks":[{"__typename":"WordPress_CoreParagraphBlock","name":"core/paragraph","attributes":{"__typename":"WordPress_CoreParagraphBlockAttributes","content":"<em>In February 2021, our security researcher Mat Rollings&nbsp;<a href=\"https://www.immersivelabs.com/resources/blog/why-so-salty-local-privilege-escalation-on-saltstack-minions/\">disclosed a local privilege escalation (CVE-2020-28243)</a>&nbsp;in&nbsp;<a href=\"https://github.com/saltstack/salt\">SaltStack's Salt</a>&nbsp;via specially crafted process names. However, while the initial fix SaltStack published did prevent command injection, it wasn’t enough; it didn’t prevent argument injection. This second vulnerability was much less severe than the original CVE, but still could have caused a low-impact denial of service.</em>","textAlign":null,"fontSize":null}},{"__typename":"WordPress_CoreHeadingBlock","name":"core/heading","attributes":{"__typename":"WordPress_CoreHeadingBlockAttributes","textAlign":null,"content":"The SaltStack fix","level":2,"textColor":null,"anchor":""}},{"__typename":"WordPress_CoreParagraphBlock","name":"core/paragraph","attributes":{"__typename":"WordPress_CoreParagraphBlockAttributes","content":"Let's start by understanding the first fix SaltStack released in an attempt to sanitize the package names to prevent the command injection. To do this, we can look at the difference between the two versions of code, available as a <a href=\"https://gitlab.com/saltstack/open/salt-patches/-/blob/master/patches/2021/01/28/3002.2.patch#L1414\">diff</a>.","textAlign":null,"fontSize":null}},{"__typename":"WordPress_CoreImageBlock","name":"core/image","attributes":{"__typename":"WordPress_CoreImageBlockAttributes","url":"https://cms.immersivelabs.com/content/uploads/2021/03/image-3.png","href":"","alt":"","caption":"<em>SaltStack’s original fix for CVE-2020-28243</em>","imageAlign":"center","widthPercentage":100,"imageFile":{"publicURL":"/static/05024197c42052aaaaf2e5ff0a755a27/image-3.png","childImageSharp":{"fluid":{"base64":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAAKCAYAAAC0VX7mAAAACXBIWXMAAAsTAAALEwEAmpwYAAABf0lEQVQoz51S2W7bMBD0/39aUBQ9UKcNLDt2a10UJVK8JVLTpdTEbpGHoIQGw9Uu9hrujDFwWkH3AwbGMHIO8YfHvsMcxhWTJ4Qb4qSA5LAkixQN0qzpHrDLCRk7ozh+wrfHB+wJ3398WPl0+kLFSlh1fcWLndmMmSvEwBB9uyZdE2qCcQ5zivBTWOGCh/Me3k/EZLuwcgjzjelfmCLuz5qQiw6nqkCvOf7rLAt9G7aReYvickDZXKkjfxe3vBsv8TutNaSQ6FiHtmXoBxJHCAgpYK2FIn+O0UbDWAOlFHIT2SelXH35nnlNqEjhFBMQF/QdR1s1qK8VBj5A9BvmMFF5aiEt23gpbXijS+owV+0gxJlU/Upqf8Z+/4Cnp4+4HB7Brxfw8idkU4L9OqO9PEOWJdnNX6O+jqxGBRkEeGI4dgVOvMCRHfDMj6jHCtx2qGWFRtZoVI3B9rcd/7PnTWXaS4qbMdETUVLBGYeQn4l18M7D0BRLWt4U677DfH4DbCwE1VkwlRIAAAAASUVORK5CYII=","aspectRatio":1.9607843137254901,"src":"/static/05024197c42052aaaaf2e5ff0a755a27/01fb3/image-3.png","srcSet":"/static/05024197c42052aaaaf2e5ff0a755a27/2abd0/image-3.png 200w,\n/static/05024197c42052aaaaf2e5ff0a755a27/94dc4/image-3.png 400w,\n/static/05024197c42052aaaaf2e5ff0a755a27/01fb3/image-3.png 732w","srcWebp":"/static/05024197c42052aaaaf2e5ff0a755a27/3c3c0/image-3.webp","srcSetWebp":"/static/05024197c42052aaaaf2e5ff0a755a27/f73af/image-3.webp 200w,\n/static/05024197c42052aaaaf2e5ff0a755a27/852ff/image-3.webp 400w,\n/static/05024197c42052aaaaf2e5ff0a755a27/3c3c0/image-3.webp 732w","sizes":"(max-width: 732px) 100vw, 732px"}}}}},{"__typename":"WordPress_CoreParagraphBlock","name":"core/paragraph","attributes":{"__typename":"WordPress_CoreParagraphBlockAttributes","content":"At a first glance, this all looks good. SaltStack made the following changes:","textAlign":null,"fontSize":null}}]},{"__typename":"WordPress_CoreColumnBlock","name":"core/column","attributes":{"__typename":"WordPress_CoreColumnBlockDeprecatedV1Attributes","width":"33.33","verticalAlignment":null},"innerBlocks":[{"__typename":"WordPress_AcfPostSidebarBlock","name":"acf/post-sidebar"},{"__typename":"WordPress_CoreImageBlock","name":"core/image","attributes":{"__typename":"WordPress_CoreImageBlockAttributes","url":"https://cms.immersivelabs.com/content/uploads/2021/02/round-1.png","href":"","alt":"Mat Rollings, author of SaltStack: further injection vulnerabilities","caption":"","imageAlign":"center","widthPercentage":25.11111111111111,"imageFile":{"publicURL":"/static/7bd1a8c303ff9b0492a88d1926020471/round-1.png","childImageSharp":{"fluid":{"base64":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAAUCAYAAACNiR0NAAAACXBIWXMAAAsTAAALEwEAmpwYAAAE+ElEQVQ4yx1U6U9UdxS9wwcTExP/i35oE2OadLFxj8ZqjQ1FAYXKMrIoIAId9mXYYVhkFRwEBasWNxxALRWRVRZZZAaEQajDptUm/arxPX63574PLzPv3d8795xzz320vPKO1t/+S+8//Ge6feeJaX7eQ+MTc1v7B6YiJibnOt68WV9bWf1H93jeagsLyytO16Jjasptdrs9WzofDpLT+drU2zdBT3vGaOj5NNHS0hotL78zMTPNuz20vv4hZHz81dqz3nHu7Z3g0dEZHnsxyy7XIk+9dDOaGM8GBqc8jx4PBYyMuijibCENDU2bUCMCQwOssOgqeZbf2mdml3h4xMl9/ZNa11/DGlioJ92jqr9/UuHZRv/ApNbz7IX2fNjJqLOjva/y3v0eEozhYSfR3NwbE4rC1I7/DJbai/FXOqTx7Ku/FRgosFEjIy41O7ukXk4vqMmpeZ52LugzM4sa1DDuK/AOAdiLIIf+7Hoeis4sByBNwSMeHZtRTVfblSWpigNPZ3BMbAlDIqOpQlO1uvqeV9feK/iq42J474dmJFS3Ol2v11wzYDS7pEt3eKGaWzr50JEY/mqbL+/ZF85790dwWEQ+X//9EXc/HeOHjwbV3XtPGYPUm661c3nFjcVj3vGbqaNzIKLtwTNubHJoxSXNnJxao/ILm/hsVBEfPBTFlsRKrrt8j+N/u8g/7DLzrr1hHGLO5qgYGwebs1VwqJXNYbnauegiURFIGVn1HXI4KqZYuxBfpuISylUC7iPPFfKVJge3PejlGzcf860/ujgoxMrbtp/kb3cE8zHvBLlXp4OzAJqthZ7JgYK8VkK3NZECAHUmPE/5n0rl6PM2YczlF28wfGSRVlzSwkkp1exzIpF37Qnjwz+dZwGRd8IjCzaEAC43gaZ+/kIpg7oKPJ2pvH0sBru8/EaOjSs1WFVW3WIo4dKy6wbI9q9P8W74eiowXQamIFkukf6J0jPrtGR0RndlzbGrrGw7H/wx2ngR/hqAwrq6ttXIXYKlgr/5PoiPHI01alAnktVx3yQ+GZD2ESkvWIF2hncbUvBBQRg2XnVwSloN19XfNSS3d/QZsZGGUsd5Do/M53PRxSooJMuQjBnMiWSHFCFJk4GkZ9QpTJptpS2M/4ZvGZl1bG9oM3ytx8SLbM0MIlxTe1vJVVXTqsngrrV03iRf/2QzmHFScrUmXUR6IsKcCw/lJfEXVhjDKYGHEim/k6lgV2A0l/MgpUnwE5Or/Onw0dgtyJxHQBIsF3Up/HLcomQIDVfauKHxAUvI8wuaDPAs62XJpBLvYuPKOC6+XAeQJGP+iy99NhE6ENYrQPwIMedoqWm1CpkUmer2nW51v62Hay/dMVYv4NcMzsltUBikEjUgsoFA65LbvIJGbwATfbcj2LRjZygBsFIYRMfYdEzPiFKxrVkJsK9/ihLWmKJCdGSTFCKjw3NdWIJdYXaOndIyLnkRIkMORy/ZSq8TihWp6bVG5uCbdsIvWdt3IHJj/4GzSvJmzbZvYPrahbgyDSzZhrCnpNYUDg69ND5fiA4RJBIGYNI+f6ajP8cRjPfD/VKmtd7YGMmX93ELDK82hiJbJflDfOYzrZe9sSkGGDbOFBiUSQQfZJ8pLf0S7dx9xqui8hYBbDOYBuLD0Apf3Aj5J+zsR3g7B4CbMk18gTbl5l0heOmFDZFfwjn6H+6q6ckIle7GAAAAAElFTkSuQmCC","aspectRatio":1,"src":"/static/7bd1a8c303ff9b0492a88d1926020471/146c3/round-1.png","srcSet":"/static/7bd1a8c303ff9b0492a88d1926020471/2abd0/round-1.png 200w,\n/static/7bd1a8c303ff9b0492a88d1926020471/94dc4/round-1.png 400w,\n/static/7bd1a8c303ff9b0492a88d1926020471/146c3/round-1.png 450w","srcWebp":"/static/7bd1a8c303ff9b0492a88d1926020471/f0887/round-1.webp","srcSetWebp":"/static/7bd1a8c303ff9b0492a88d1926020471/f73af/round-1.webp 200w,\n/static/7bd1a8c303ff9b0492a88d1926020471/852ff/round-1.webp 400w,\n/static/7bd1a8c303ff9b0492a88d1926020471/f0887/round-1.webp 450w","sizes":"(max-width: 450px) 100vw, 450px"}}}}},{"__typename":"WordPress_CoreParagraphBlock","name":"core/paragraph","attributes":{"__typename":"WordPress_CoreParagraphBlockAttributes","content":"<strong>Mat Rollings, </strong><br>Senior Application Security Engineer<br>Twitter: <a rel=\"noreferrer noopener\" href=\"https://twitter.com/stealthcopter\" target=\"_blank\">@stealthcopter</a><br>Blog: <a href=\"http://sec.stealthcopter.com/\" target=\"_blank\" rel=\"noreferrer noopener\">sec.stealthcopter.com</a>","textAlign":"center","fontSize":null}}]}]},{"__typename":"WordPress_CoreListBlock","name":"core/list","attributes":{"values":"<li>Removal of <code>shell=True</code>, which prevents command chaining or redirection using a control character like <code>&gt;</code>, <code>||</code>, <code>&amp;&amp;</code>, or <code>;</code>\n</li><li>Addition of <a href=\"https://docs.python.org/3/library/shlex.html\">shlex</a>, a command shell sanitizing library, in an attempt to sanitize the command</li>","ordered":false}},{"__typename":"WordPress_CoreHeadingBlock","name":"core/heading","attributes":{"__typename":"WordPress_CoreHeadingBlockAttributes","textAlign":null,"content":"The SaltStack error","level":2,"textColor":null,"anchor":""}},{"__typename":"WordPress_CoreParagraphBlock","name":"core/paragraph","attributes":{"__typename":"WordPress_CoreParagraphBlockAttributes","content":"The developer that added this fix made an error. Their usage of shlex does not provide any additional protection. The <code>shlex.split</code> function takes an input string and splits it into the command and its arguments using spaces as the delimiter. We control the package variable, which means we can inject additional arguments into the command.","textAlign":null,"fontSize":null}},{"__typename":"WordPress_CoreParagraphBlock","name":"core/paragraph","attributes":{"__typename":"WordPress_CoreParagraphBlockAttributes","content":"This advanced form of command injection is known as <strong>argument injection</strong>. Typical command injection can fail if subshells or redirection are blocked, yet argument injection can still work under the same conditions – and even when sanitization occurs.","textAlign":null,"fontSize":null}},{"__typename":"WordPress_CoreParagraphBlock","name":"core/paragraph","attributes":{"__typename":"WordPress_CoreParagraphBlockAttributes","content":"The screenshot below shows the <code>dpkg</code> command running with two inputs. The first is a regular package name, and the second is one that will be interpreted as an argument and cause unintended execution paths.","textAlign":null,"fontSize":null}},{"__typename":"WordPress_CoreImageBlock","name":"core/image","attributes":{"__typename":"WordPress_CoreImageBlockAttributes","url":"https://cms.immersivelabs.com/content/uploads/2021/03/image-2.png","href":"","alt":"","caption":"<em>dpkg running with a regular package name and an unexpected argument</em>","imageAlign":"center","widthPercentage":100,"imageFile":{"publicURL":"/static/a4146518e4e0b826ac54d901295a14fb/image-2.png","childImageSharp":{"fluid":{"base64":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAAICAYAAAD5nd/tAAAACXBIWXMAAAsTAAALEwEAmpwYAAABM0lEQVQoz5VRSXLCQBDzT0IwXsHGNl6xgYSwVoAsb8j/v6BIA75kq8pBNe0etUZWW9vjHqfLC85v77gcjvh4PuF1u8V6t0e7XKGet6jbDmUzR1E3KKoaOTHNZkiINM+Rzoi8QEZY9bzDw9PGkCWwelyjWSzRsS7ZM4KEBjUg3qysjFg0TeAGIbwwhOMHGDourHE8NUSXjZCEhOQ4za4vFiXdVKbO2Zcz1RPy5Fi9/k4zErfcIIDjBfDGE0Suh3TkwOU54DmwRz/innd3Q/tbzzisu/b6mrKh2wVfzwjb82FT+L+wZFnZ+XToRzHy2xL0CwnDbm4LEUfRyEU/rPrrt6U8dtyu8pLA6XwxmVQU2ewPiJLUBO6FY5NRP/irw5CuNCxH2p62KLeqe6fBJDKn+n+JCZ/PhPjPg/3A5gAAAABJRU5ErkJggg==","aspectRatio":2.5,"src":"/static/a4146518e4e0b826ac54d901295a14fb/e010a/image-2.png","srcSet":"/static/a4146518e4e0b826ac54d901295a14fb/2abd0/image-2.png 200w,\n/static/a4146518e4e0b826ac54d901295a14fb/94dc4/image-2.png 400w,\n/static/a4146518e4e0b826ac54d901295a14fb/e010a/image-2.png 726w","srcWebp":"/static/a4146518e4e0b826ac54d901295a14fb/51b4e/image-2.webp","srcSetWebp":"/static/a4146518e4e0b826ac54d901295a14fb/f73af/image-2.webp 200w,\n/static/a4146518e4e0b826ac54d901295a14fb/852ff/image-2.webp 400w,\n/static/a4146518e4e0b826ac54d901295a14fb/51b4e/image-2.webp 726w","sizes":"(max-width: 726px) 100vw, 726px"}}}}},{"__typename":"WordPress_CoreParagraphBlock","name":"core/paragraph","attributes":{"__typename":"WordPress_CoreParagraphBlockAttributes","content":"Triggering an argument injection like this might not seem exciting at first. But it can cause crashes in poorly written applications where unexpected output is not accounted for, eventually leading to a denial of service. If we manage to directly control the output, we may be able to control the execution flow of the application, leading to further compromise.","textAlign":null,"fontSize":null}},{"__typename":"WordPress_CoreParagraphBlock","name":"core/paragraph","attributes":{"__typename":"WordPress_CoreParagraphBlockAttributes","content":"More advanced argument injections can achieve code execution, but these rely on finding a suitable argument to be abused. Unfortunately, none of the arguments that can be passed to the three package commands, <code>dpkg</code>, <code>repoquery</code> or <code>opkg</code>, appear to be exploitable for this purpose, so code execution does not appear possible.<br>However, we can bring about a denial of service by causing the command to hang indefinitely. A fifo file, created using the <code>mkfifo</code> command, is a file that cannot be read until it is written to. This can cause any program reading from this file to hang.","textAlign":null,"fontSize":null}},{"__typename":"WordPress_CoreImageBlock","name":"core/image","attributes":{"__typename":"WordPress_CoreImageBlockAttributes","url":"https://cms.immersivelabs.com/content/uploads/2021/03/image-1.png","href":"","alt":"","caption":"<em>Example command that will cause a hang in dpkg-query</em>","imageAlign":"center","widthPercentage":100,"imageFile":{"publicURL":"/static/7a9ab55e87eb4cdd31e01e97c746cf7b/image-1.png","childImageSharp":{"fluid":{"base64":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAADCAYAAACTWi8uAAAACXBIWXMAAAsTAAALEwEAmpwYAAAAq0lEQVQI122Pxw6CUBBF+f9vcWsUiBSNAtKblPCoItEoC1vYXfEtjCYuzmbm5EyGEa0cvJ5iwqnQszNkp8Rc2UFyCnDbBIJJYOY9dt2AoH3C3z8QHgZ4zR1OdYVb335gWDXGdOWB0+KRBPwYkd2KBpWoA6tGmK0DCBahrMN2dFJo6ekT/Q4zK7+BaOdUlOwCS6+GSXoY5ELF9/z9heyWdLcZjyyMDFpy/Bt8AV1e0mQuZNaJAAAAAElFTkSuQmCC","aspectRatio":6.451612903225806,"src":"/static/7a9ab55e87eb4cdd31e01e97c746cf7b/ff04e/image-1.png","srcSet":"/static/7a9ab55e87eb4cdd31e01e97c746cf7b/2abd0/image-1.png 200w,\n/static/7a9ab55e87eb4cdd31e01e97c746cf7b/94dc4/image-1.png 400w,\n/static/7a9ab55e87eb4cdd31e01e97c746cf7b/ff04e/image-1.png 421w","srcWebp":"/static/7a9ab55e87eb4cdd31e01e97c746cf7b/df5c8/image-1.webp","srcSetWebp":"/static/7a9ab55e87eb4cdd31e01e97c746cf7b/f73af/image-1.webp 200w,\n/static/7a9ab55e87eb4cdd31e01e97c746cf7b/852ff/image-1.webp 400w,\n/static/7a9ab55e87eb4cdd31e01e97c746cf7b/df5c8/image-1.webp 421w","sizes":"(max-width: 421px) 100vw, 421px"}}}}},{"__typename":"WordPress_CoreParagraphBlock","name":"core/paragraph","attributes":{"__typename":"WordPress_CoreParagraphBlockAttributes","content":"When a custom admin directory is set, <code>dpkg-query</code> will attempt to read a file in this directory named <strong>status</strong>. As we have made a fifo file with this name in the tmp directory, the command will hang indefinitely.","textAlign":null,"fontSize":null}},{"__typename":"WordPress_CoreParagraphBlock","name":"core/paragraph","attributes":{"__typename":"WordPress_CoreParagraphBlockAttributes","content":"When this process hangs, both the master and minion will continue to function as normal but the process that called the restart check will hang indefinitely. As such, this exploit is pretty low in severity.","textAlign":null,"fontSize":null}},{"__typename":"WordPress_CoreHeadingBlock","name":"core/heading","attributes":{"__typename":"WordPress_CoreHeadingBlockAttributes","textAlign":null,"content":"<strong>What happened next?</strong>","level":2,"textColor":null,"anchor":""}},{"__typename":"WordPress_CoreParagraphBlock","name":"core/paragraph","attributes":{"__typename":"WordPress_CoreParagraphBlockAttributes","content":"<strong>Coordinated disclosure</strong> is a process of sharing the suggested solution with the reporter before it’s released publicly. The reporter can then test and propose modifications where it does not adequately fix the vulnerability. Unfortunately, SaltStack initially published the security fix without coordinated disclosure with the author. If they had communicated on the solution, the issue would have been spotted and a secondary fix wouldn’t have been necessary.","textAlign":null,"fontSize":null}},{"__typename":"WordPress_CoreParagraphBlock","name":"core/paragraph","attributes":{"__typename":"WordPress_CoreParagraphBlockAttributes","content":"Thankfully, the second time around SaltStack shared the fix for approval before publication. This is a step in the right direction and shows more of a proactive than reactive approach to security, which is always better in the long run.","textAlign":null,"fontSize":null}},{"__typename":"WordPress_CoreHeadingBlock","name":"core/heading","attributes":{"__typename":"WordPress_CoreHeadingBlockAttributes","textAlign":null,"content":"The new SaltStack fix","level":2,"textColor":null,"anchor":""}},{"__typename":"WordPress_CoreParagraphBlock","name":"core/paragraph","attributes":{"__typename":"WordPress_CoreParagraphBlockAttributes","content":"The final solution SaltStack implemented avoids the need to use shlex to escape the command string as it builds an array that is passed to <code>popen</code>. This ensures that the package name can only ever be a single argument as spaces and quotes will be escaped automatically.","textAlign":null,"fontSize":null}},{"__typename":"WordPress_CoreImageBlock","name":"core/image","attributes":{"__typename":"WordPress_CoreImageBlockAttributes","url":"https://cms.immersivelabs.com/content/uploads/2021/03/image-4.png","href":"","alt":"","caption":"<em>SaltStack’s updated fix for CVE-2020-28243</em>","imageAlign":"center","widthPercentage":100,"imageFile":{"publicURL":"/static/89cc8c2de747153252595e173af65ccb/image-4.png","childImageSharp":{"fluid":{"base64":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAASCAYAAABb0P4QAAAACXBIWXMAAAsTAAALEwEAmpwYAAACdUlEQVQ4y6VUiXLbIBDV//9fkyZ2dB9Gt5BAIIReFuykSdo60ykzz/vYgdUeDwdps6AcFeJGImQCCdmoFjhVC9ik0C8bGq496kljoH1L3Pm7mfisIfQOYw9shKBlDCzPsEkJv47D/ZA5YOnA/gX2i3U4/B1/GUFXlSjOZzQUdOHcO/9nBSVrEWUFLu0AoQwkpa+NxUrWcWfVZj1X2/7ufzuz0J2V/Pp2JnBBspLhJYyR5iUens44EXfW+bOyxrSs7x8Tascsr3xZDSax+aBuz+WGwO47to2anuZgYYI6y9EWFQoKODUteNOgp70xO+zxsV9/KXmjg27FeYXnMENxaVDVHc5J4XlDQV1bZqFhdutxnd3xR/gM13VFEYXIzyeUSYw8jhA9/EDHLmjqGnmWQorlfZL3sgy0Np5URYPolIJdWoz9hDQqwVgHzheMBKn03cx+ZWgtHJIkQUzZFQWVWlYIKeMoinBxsipK1HUDrfX3PdT0ZVdyGaWIH0+okpTwhPQ5REOB256D1Qm6rsY4jDTAzSewU6veYD/YwBjjX0dKU47iHF3fY14aDOMMPjsICNnSlNdbyRaHveGwn/eEgJOO6m5CO3CMi8IwS5qoQc8l8RUD2X4iOyuvN04anNer7pwGR8LqNXj1BYqGIqSivl2QOf1RmWleYJoXP5BhmukVkFbpZTjoGxx3L8fBScn5nA2suU5ZlCV4lmE4kaCjGEtVYa0ZtFr/7S1LtXmSlj2iYsBjyPDzhWEg6Wy78ZOV9E/0BjfA456wXSPdqulFtN1AJXKIVVEb6PItgBDCw3Gl1Cc9/pbhRI13zbSUjbmV/926p8VXEIxypHa7dEwAAAAASUVORK5CYII=","aspectRatio":1.1363636363636365,"src":"/static/89cc8c2de747153252595e173af65ccb/2078d/image-4.png","srcSet":"/static/89cc8c2de747153252595e173af65ccb/2abd0/image-4.png 200w,\n/static/89cc8c2de747153252595e173af65ccb/94dc4/image-4.png 400w,\n/static/89cc8c2de747153252595e173af65ccb/2078d/image-4.png 709w","srcWebp":"/static/89cc8c2de747153252595e173af65ccb/72a19/image-4.webp","srcSetWebp":"/static/89cc8c2de747153252595e173af65ccb/f73af/image-4.webp 200w,\n/static/89cc8c2de747153252595e173af65ccb/852ff/image-4.webp 400w,\n/static/89cc8c2de747153252595e173af65ccb/72a19/image-4.webp 709w","sizes":"(max-width: 709px) 100vw, 709px"}}}}},{"__typename":"WordPress_CoreParagraphBlock","name":"core/paragraph","attributes":{"__typename":"WordPress_CoreParagraphBlockAttributes","content":"A further addition was the <code>--</code> argument in each of the <code>cmd_pkg_query</code> variables. In most POSIX compatible commands, the <code>--</code> argument signifies the end of all option arguments, and all subsequent arguments are treated as string literals, even if they begin with <code>-</code> or <code>--</code>. This little-known tip is handy when passing user-controlled parameters to commands as it can protect against argument injection. For more information, check out these <a href=\"https://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap12.html#tag_12_02\">Utility Syntax Guidelines</a>.","textAlign":null,"fontSize":null}},{"__typename":"WordPress_CoreHeadingBlock","name":"core/heading","attributes":{"__typename":"WordPress_CoreHeadingBlockAttributes","textAlign":null,"content":"Conclusion","level":2,"textColor":null,"anchor":""}},{"__typename":"WordPress_CoreParagraphBlock","name":"core/paragraph","attributes":{"__typename":"WordPress_CoreParagraphBlockAttributes","content":"The security fix for the original vulnerability was released on 4th February 2021, and the updated fix was released on the 23rd March 2021. You can find out more about <strong>CVE-2020-28243 </strong>over on the SaltStack announcement <a href=\"https://saltproject.io/security_announcements/active-saltstack-cve-release-2021-feb-25/\">here</a>.","textAlign":null,"fontSize":null}},{"__typename":"WordPress_CoreParagraphBlock","name":"core/paragraph","attributes":{"__typename":"WordPress_CoreParagraphBlockAttributes","content":"Fixing security vulnerabilities is a difficult task to get right, especially when the pressure is on to hit a deadline. Are you confident your web applications are secure? Immersive Labs’ series on <strong>Python Secure Coding</strong> is the best place to practice and level up your skills in identifying, exploiting, securing and validating common vulnerabilities in web applications. Log in to check this out.","textAlign":null,"fontSize":null}},{"__typename":"WordPress_CoreParagraphBlock","name":"core/paragraph","attributes":{"__typename":"WordPress_CoreParagraphBlockAttributes","content":"If you're an Immersive Labs user, book a demo today for a tour of our human cyber readiness platform.","textAlign":null,"fontSize":null}},{"__typename":"WordPress_AcfButtonBlock","name":"acf/button","acf":{"buttonType":"link","buttonLink":{"title":"Get a demo","url":"https://www.immersivelabs.com/demo","target":""},"buttonText":null,"formIntroContent":null,"hubspotPortalId":null,"hubspotFormId":null,"ctaPost":null,"buttonStyle":"fill","buttonSize":"large"}},{"__typename":"WordPress_CoreParagraphBlock","name":"core/paragraph","attributes":{"__typename":"WordPress_CoreParagraphBlockAttributes","content":"","textAlign":null,"fontSize":null}}],"seo":{"title":"SaltStack: further injection vulnerabilities - Immersive Labs","metaDesc":"The fix for CVE-2020-28243 in SaltStack may have prevented command injection – but it wasn’t enough. Immersive Labs' Mat Rollings explains why.","metaKeywords":"","canonical":"","opengraphType":"article","opengraphTitle":"SaltStack: further injection vulnerabilities - Immersive Labs","opengraphDescription":"The fix for CVE-2020-28243 in SaltStack may have prevented command injection – but it wasn’t enough. Immersive Labs' Mat Rollings explains why.","opengraphImage":{"sourceUrl":"https://cms.immersivelabs.com/content/uploads/2020/05/shutterstock1151933516-1-scaled.jpg","uri":"https://www.immersivelabs.com/resources/blog/how-to-lock-onto-the-hackers-targeting-saltstack-minions/sea-salt-and-himalayan-in-burlap-crystals-of-salt-on-table/"}},"featuredImage":{"sourceUrl":"https://cms.immersivelabs.com/content/uploads/2020/05/shutterstock1151933516-1-scaled.jpg","imageFile":{"publicURL":"/static/608751b52e9f7c5afc183dde01eb5984/shutterstock1151933516-1-scaled.jpg","childImageSharp":{"fluid":{"base64":"data:image/jpeg;base64,/9j/2wBDABALDA4MChAODQ4SERATGCgaGBYWGDEjJR0oOjM9PDkzODdASFxOQERXRTc4UG1RV19iZ2hnPk1xeXBkeFxlZ2P/2wBDARESEhgVGC8aGi9jQjhCY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2P/wgARCAANABQDASIAAhEBAxEB/8QAFwAAAwEAAAAAAAAAAAAAAAAAAAIDBP/EABUBAQEAAAAAAAAAAAAAAAAAAAAB/9oADAMBAAIQAxAAAAF0nWXUYA//xAAaEAEBAAIDAAAAAAAAAAAAAAACAQATAxEj/9oACAEBAAEFAoHq9Jk4zYWgdrud5//EABQRAQAAAAAAAAAAAAAAAAAAABD/2gAIAQMBAT8BP//EABQRAQAAAAAAAAAAAAAAAAAAABD/2gAIAQIBAT8BP//EAB0QAAIBBAMAAAAAAAAAAAAAAAABAhARITESQWH/2gAIAQEABj8CU12ZjjwvyElo3T//xAAcEAACAgIDAAAAAAAAAAAAAAAAAREhMVFhcfD/2gAIAQEAAT8hiwq40JWT7BGaErDHl9BTFVcHtn//2gAMAwEAAgADAAAAELsv/8QAFxEBAQEBAAAAAAAAAAAAAAAAAQARUf/aAAgBAwEBPxATlt//xAAWEQADAAAAAAAAAAAAAAAAAAAAARH/2gAIAQIBAT8QjIz/xAAcEAEBAAIDAQEAAAAAAAAAAAABEQAhMUFhUXH/2gAIAQEAAT8Q1A6UtF0zvAkZ89R+fc1PMkKHuTag0tzHz8QmWgoq8rj/2Q==","aspectRatio":1.5,"src":"/static/608751b52e9f7c5afc183dde01eb5984/6f8be/shutterstock1151933516-1-scaled.jpg","srcSet":"/static/608751b52e9f7c5afc183dde01eb5984/6aaa1/shutterstock1151933516-1-scaled.jpg 300w,\n/static/608751b52e9f7c5afc183dde01eb5984/05631/shutterstock1151933516-1-scaled.jpg 600w,\n/static/608751b52e9f7c5afc183dde01eb5984/6f8be/shutterstock1151933516-1-scaled.jpg 1200w,\n/static/608751b52e9f7c5afc183dde01eb5984/8522c/shutterstock1151933516-1-scaled.jpg 1800w,\n/static/608751b52e9f7c5afc183dde01eb5984/7a99c/shutterstock1151933516-1-scaled.jpg 2000w","srcWebp":"/static/608751b52e9f7c5afc183dde01eb5984/8edc8/shutterstock1151933516-1-scaled.webp","srcSetWebp":"/static/608751b52e9f7c5afc183dde01eb5984/fdc3b/shutterstock1151933516-1-scaled.webp 300w,\n/static/608751b52e9f7c5afc183dde01eb5984/47049/shutterstock1151933516-1-scaled.webp 600w,\n/static/608751b52e9f7c5afc183dde01eb5984/8edc8/shutterstock1151933516-1-scaled.webp 1200w,\n/static/608751b52e9f7c5afc183dde01eb5984/626fa/shutterstock1151933516-1-scaled.webp 1800w,\n/static/608751b52e9f7c5afc183dde01eb5984/3835e/shutterstock1151933516-1-scaled.webp 2000w","sizes":"(max-width: 1200px) 100vw, 1200px"}}}},"tags":{"edges":[{"node":{"name":"CVEs","slug":"cves","count":2,"attributes":{"colorTheme":"electricBlue"}}},{"node":{"name":"Threats","slug":"threats","count":21,"attributes":{"colorTheme":"electricBlue"}}}]},"categories":{"edges":[{"node":{"name":"All Resources","slug":"all-resources","count":352,"attributes":{"colorTheme":"electricBlue"}}},{"node":{"name":"Blog","slug":"blog","count":189,"attributes":{"colorTheme":"electricBlue"}}}]},"attributes":{"schema":"{\r\n  \"@context\": \"https://schema.org\",\r\n  \"@type\": \"NewsArticle\",\r\n  \"mainEntityOfPage\": {\r\n    \"@type\": \"WebPage\",\r\n    \"@id\": \"https://google.com/article\"\r\n  },\r\n  \"headline\": \"$title\",\r\n  \"image\": [\r\n    \"$featuredImage\"\r\n   ],\r\n  \"datePublished\": \"$date\",\r\n  \"dateModified\": \"$modified\",\r\n  \"author\": {\r\n    \"@type\": \"Person\",\r\n    \"name\": \"$author\"\r\n  },\r\n   \"publisher\": {\r\n    \"@type\": \"Organization\",\r\n    \"name\": \"Immersive Labs\",\r\n    \"logo\": {\r\n      \"@type\": \"ImageObject\",\r\n      \"url\": \"$logo\"\r\n    }\r\n  }\r\n}","postIncognito":null},"author":{"name":"Immersive Labs","attributes":{"userAvatarImage":{"altText":"","sourceUrl":"https://cms.immersivelabs.com/content/uploads/2020/06/0bdac40f82cf9e85a5e1cc04ef4a9af2.jpg","imageFile":{"publicURL":"/static/4b4dc210573184658e94223497b65cd5/0bdac40f82cf9e85a5e1cc04ef4a9af2.jpg","childImageSharp":{"fluid":{"base64":"data:image/jpeg;base64,/9j/2wBDABALDA4MChAODQ4SERATGCgaGBYWGDEjJR0oOjM9PDkzODdASFxOQERXRTc4UG1RV19iZ2hnPk1xeXBkeFxlZ2P/2wBDARESEhgVGC8aGi9jQjhCY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2P/wgARCAAUABQDASIAAhEBAxEB/8QAFwABAQEBAAAAAAAAAAAAAAAAAAUEA//EABQBAQAAAAAAAAAAAAAAAAAAAAD/2gAMAwEAAhADEAAAAaWTdOKwOU4KgP/EAB0QAAICAQUAAAAAAAAAAAAAAAEDAAIEERIiIzH/2gAIAQEAAQUCeSFrO1sYNaJt2S3mKOU//8QAFBEBAAAAAAAAAAAAAAAAAAAAIP/aAAgBAwEBPwEf/8QAFBEBAAAAAAAAAAAAAAAAAAAAIP/aAAgBAgEBPwEf/8QAGxABAAICAwAAAAAAAAAAAAAAAQIQABEhMWH/2gAIAQEABj8C4de4BKUh73Thtta//8QAHBAAAgICAwAAAAAAAAAAAAAAAREAMRAhQVHR/9oACAEBAAE/IeRE76CNLBYFwXYgEO9wW0ALRFRz/9oADAMBAAIAAwAAABCzDwD/xAAUEQEAAAAAAAAAAAAAAAAAAAAg/9oACAEDAQE/EB//xAAUEQEAAAAAAAAAAAAAAAAAAAAg/9oACAECAQE/EB//xAAcEAEAAgIDAQAAAAAAAAAAAAABABEhQRAxUWH/2gAIAQEAAT8QcK0AC3ZUfyQBMXjhHFEs8SOcEsL0uFS6sTEcGDSdZl/k/9k=","aspectRatio":1,"src":"/static/4b4dc210573184658e94223497b65cd5/5c772/0bdac40f82cf9e85a5e1cc04ef4a9af2.jpg","srcSet":"/static/4b4dc210573184658e94223497b65cd5/07fa7/0bdac40f82cf9e85a5e1cc04ef4a9af2.jpg 150w,\n/static/4b4dc210573184658e94223497b65cd5/5c772/0bdac40f82cf9e85a5e1cc04ef4a9af2.jpg 192w","srcWebp":"/static/4b4dc210573184658e94223497b65cd5/0814e/0bdac40f82cf9e85a5e1cc04ef4a9af2.webp","srcSetWebp":"/static/4b4dc210573184658e94223497b65cd5/ef536/0bdac40f82cf9e85a5e1cc04ef4a9af2.webp 150w,\n/static/4b4dc210573184658e94223497b65cd5/0814e/0bdac40f82cf9e85a5e1cc04ef4a9af2.webp 192w","sizes":"(max-width: 192px) 100vw, 192px"}}}},"userJobTitle":"Senior Developer"}}}}},"pageContext":{"id":"cG9zdDoxNTY4Ng==","slug":"saltstack-further-injection-vulnerabilities"}},"staticQueryHashes":["1134781590","1430943121","1691173908","2407081983","2499683418","3123027226","3518138710","3678308812","4001368598","4116960265","437961647"]}