9.6

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2024-38824

CVE-2024-38824: Salt vulnerable to directory traversal attack in file receiving method

Directory traversal vulnerability in recv_file method allows arbitrary files to be written to the master cache directory.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2024-38824

CVE-2024-38824:

9.6

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
salt	pip	>= 3007.0rc1, < 3007.4	3007.4
salt	pip	>= 3006.0rc1, < 3006.12	3006.12

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the _file_recv method within the salt/master.py file of the SaltStack project. The method is responsible for receiving files and storing them in the master's cache directory.

The original code constructed the destination path (cpath) by joining the base cache directory, minion ID, 'files', and a normalized path derived from user input (load["path"]). The security check involved normalizing cpath and verifying if it started with the configured cache directory path (self.opts["cachedir"]). This check was inadequate because os.path.normpath could be bypassed with certain path traversal sequences (e.g., ../../..), allowing an attacker to write files to arbitrary locations on the master server, limited by the permissions of the Salt master process.

The patch addresses this by first defining a base restricted path (rpath) and then joining the user-provided path (normpath) to it. Crucially, it replaces the weak startswith check with a call to salt.utils.verify.clean_path(rpath, cpath). This function is designed to properly sanitize and validate file paths, ensuring that the final path cpath is confined within the intended rpath directory, thus preventing the directory traversal.

Therefore, the _file_recv function is the direct point of vulnerability as it processes the user-controlled path and performs the file write operation. During exploitation, this function would be in the call stack when the malicious file write occurs.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.