CVE-2020-11651 KEVPublic exploit Critical · 9.8 EPSS 96.6%

SaltStack Salt Authentication Bypass Vulnerability

Summary

A flaw in the ClearFuncs class of the salt-master process in SaltStack Salt does not properly validate method calls, so some methods can be reached without authentication. A remote, unauthenticated attacker with network access to the salt master can exploit it, with no user interaction or special configuration required, to retrieve user tokens from the salt master and/or run arbitrary commands on salt minions.

Official description · NVD

An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class does not properly validate method calls. This allows a remote user to access some methods without authentication. These methods can be used to retrieve user tokens from the salt master and/or run arbitrary commands on salt minions.

Breakdown

66.8 / 100

Exploited: Yes, in CISA KEV
Reports: 0
Tactics: 2/15

How an attack unfolds

Based on mappings. Select a step to see the evidence.

How attackers get in
- Break in through an internet-facing appT1190 · Exploit Public-Facing ApplicationAI-written (claude-haiku-5-5)Medium confidence149 general detection rules
What can follow
- Run commands on the systemT1059 · Command and Scripting InterpreterSource dataMedium confidence95 general detection rules

First seen exploited 3 months after disclosure. Public exploit code (Metasploit) was available the same day.

DisclosedPublic exploit codeMetasploit30 Apr 2020day 0
First seen exploitedVulnCheck KEV evidence22 Jul 2020+3 mo
Added to CISA KEVEU database agrees3 Nov 2021+18 mo

CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.

7 fixes in salt over 2 years. The latest fix listed for salt is 3002.1.

Fixes in saltPyPI package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

2018.3.3CVE-2018-1575124 Oct 2018
2018.3.4CVE-2019-101025918 Jul 2019
2019.2.3CVE-2019-1736117 Jan 2020
3000.2CVE-2020-1165130 Apr 2020KEV
3000.2CVE-2020-1165230 Apr 2020KEV
3002.1CVE-2020-168466 Nov 2020KEV
3002.1CVE-2020-174906 Nov 2020Latest listed

techniques

2 , grouped by in kill-chain order, 2 cited passages 11

Initial AccessTA0001

Exploit Public-Facing Application T1190 Medium

AI mapping from the description · how it is exploited

unauthenticated remote access to public-facing service

allows a remote user to access some methods without authentication

From the official description (NVD) Original ↗

ExecutionTA0002

Command and Scripting Interpreter T1059 Medium

MITRE CTID mapping of the CVE · uncategorised

Lower-confidence links (2)

These come from early or generic mappings, text matching, or contradict this CVE’s details (for example a public-facing technique on a bug that needs a user to open a file). Shown for completeness.

Exploitation for Privilege EscalationT1068 CTID attack_to_cve Phase 1 "Uncategorized" mapping (not staged by impact)
Steal Application Access TokenT1528 CTID attack_to_cve Phase 1 "Uncategorized" mapping (not staged by impact)

Detection

0 rules for this CVE · 244 general rules for its techniques

Rules for this CVE

0 that reference CVE-2020-11651 directly.

CVE-specific rules are not available in this build. Search SigmaHQ ↗

General rules for this CVE’s techniques

These detect the technique in general, not this specific vulnerability.

Exploit Public-Facing ApplicationT1190149 general rules

Arcadyan Router Exploitationscriticaltest
Citrix ADS Exploitation CVE-2020-8193 CVE-2020-8195criticaltest
Citrix Netscaler Attack CVE-2019-19781criticaltest
Confluence Exploitation CVE-2019-3398criticaltest
CVE-2010-5278 Exploitation Attemptcriticaltest
CVE-2020-0688 Exchange Exploitation via Web Logcriticaltest
CVE-2020-10148 SolarWinds Orion API Auth Bypasscriticaltest
CVE-2020-5902 F5 BIG-IP Exploitation Attemptcriticaltest

All 149 on SigmaHQ ↗

Command and Scripting InterpreterT105995 general rules

HackTool - Sliver C2 Implant Activity Patterncriticaltest
Lazarus Group Activitycriticaltest
REvil Kaseya Incident Malware Patternscriticaltest
Turla Group Lateral Movementcriticaltest
Windows Defender AMSI Trigger Detectedhighstable
Windows Defender Threat Detectedhighstable
Abusable DLL Potential Sideloading From Suspicious Locationhightest
Add Insecure Download Source To Wingethightest

All 95 on SigmaHQ ↗

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: salt.

PyPIsaltGHSA-pjhf-vpx3-33r3 PYSEC-2020-102

Upgrade to 3000.7 or later

Fixes this CVE and 6 other known vulnerabilities in this package (CVE-2020-11652, CVE-2020-16846, +4).

pippip install "salt>=3000.7"

First fixed in 3000.2 for CVE-2020-11651.

Affected versions, by release line

If you run	Upgrade to
3000 up to 3000.2	3000.7first fix for this CVE: 3000.2
All versions before 2019.2.4	2019.2.8first fix for this CVE: 2019.2.4

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

References

12 links, grouped by NVD tag (11 duplicates merged)

Exploitation evidence

Exploited in the wild

Listed since 3 Nov 2021. Federal due date 3 May 2022. No recorded ransomware use.

Apply updates per vendor instructions.

ENISA

Marked exploited since 3 Nov 2021. EUVD-2020-0171

Saltstack 3000.1 - Remote Code ExecutionEDB-48421 · remote · multiple · 2020-05-05

, 31 Oct 2026

96.6%Top 0.12%

Chance of exploitation in the next 30 days. of scored CVEs (riskier than 99.88%).

3.1

9.8Critical · 9.8

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Priority factorsFormula

In a KEV cataloglisted in CISA KEV and VulnCheck KEV 35.0/35

Recent KEV listingadded 2293 days ago 0.0/10

Known ransomware usenot known 0.0/10

EPSS percentilepercentile 0.9988 20.0/20

Threat reports0 reports 0.0/10

Public exploit code2 NVD references tagged Exploit; 1 Exploit-DB entry; 14 PoC-in-GitHub repos; 2 Metasploit modules 5.0/5

CVSS base scorebase score 9.8 6.9/7

End-of-life productsupported or unknown 0.0

Total66.8

Record

Published: 30 Apr 2020
Modified: 17 Jun 2026
: None assigned
Elsewhere: NVD CVE.org KEV JSON

How an attack unfolds

1How attackers get in

2What can follow

Exploitation timelineExploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.

Patch historyPatch historyEarlier and later CVEs in the same code, in date order. It shows when a fix was bypassed or incomplete and which version finally fixed it.

Fixes in saltPyPI package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

ATT&CKMITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques

Initial AccessTA0001

ExecutionTA0002

Detection

Rules for this CVE

General rules for this CVE’s techniques

Am I affected? What do I upgrade to?

Affected versions, by release line

What security researchers reported

References

Vendor Advisory 1

US Government Resource 1

Third Party Advisory 10

How attackers get in

What can follow

techniques