9.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2020-25592

CVE-2020-25592: SaltStack Salt Improper Validation of eauth credentials and tokens in salt-netapi

In SaltStack the salt-netapi improperly validates eauth credentials and tokens. A user can bypass authentication and invoke Salt SSH.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2020-25592

CVE-2020-25592:

9.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
salt	pip	< 2015.8.13	2015.8.13
salt	pip	>= 2016.3.0, < 2016.3.8	2016.3.8
salt	pip	>= 2016.11.0, < 2016.11.10	2016.11.10
salt	pip	>= 2017.5.0, < 2017.7.8	2017.7.8
salt	pip	>= 2018.2.0, < 2018.3.5	2018.3.5
salt	pip	>= 2019.2.0, < 2019.2.7	2019.2.7
salt	pip	>= 3000.0, < 3000.5	3000.5
salt	pip	>= 3001.0, < 3001.3	3001.3
salt	pip	>= 3002.0, < 3002.1	3002.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability stems from improper validation of 'eauth' and token parameters in salt-netapi's SSH handling. The SaltSSH class in salt/netapi/rest_cherrypy/app.py is directly responsible for processing SSH requests via the API, where authentication checks were insufficient. The token validation logic in salt.auth.Resolver is also implicated, as the CVE description specifically mentions ACL validation flaws. While the exact function names aren't explicitly listed in the advisory, the salt-netapi component's SSH handling and authentication flow are clearly identified as the vulnerable areas in multiple sources, including SaltStack's own release notes and CVE descriptions.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.