5.6

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-22241

CVE-2025-22241: Salt's file contents overwrite the VirtKey class

File contents overwrite the VirtKey class is called when “on-demand pillar” data is requested and uses un-validated input to create paths to the “pki directory”. The functionality is used to auto-accept Minion authentication keys based on a pre-placed “authorization file” at a specific location and is present in the default configuration.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-22241

CVE-2025-22241:

5.6

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
salt	pip	>= 3007.0rc1, < 3007.4	3007.4
salt	pip	>= 3006.0rc1, < 3006.12	3006.12

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability (CVE-2025-22241) allows for file content overwrite via the VirtKey class due to unvalidated input in on-demand pillar data, specifically when creating paths to the 'pki directory'. The root cause is improper validation of remote URLs when using git as an on-demand external pillar source.

The primary vulnerable function is salt.utils.gitfs.GitFS.init_remotes. Before the patch, this function would iterate over a list of remote URLs and use them to initialize git providers without proper validation. An attacker could craft a malicious URL (e.g., an SSH URL with an injected sshCommand) that, when processed by git, would lead to arbitrary command execution on the Salt Master. This command execution could be used to create or overwrite files, potentially targeting the PKI directory and affecting components like VirtKey.

The entry point for this vulnerability is salt.master.AESFuncs._pillar. This function handles requests for pillar data and processes the 'ext' field, which contains the on-demand pillar configuration. When a malicious git pillar URL is provided in 'ext', _pillar initiates the process that eventually calls GitFS.init_remotes with the unvalidated URL.

Additionally, salt.pillar.Pillar.__valid_on_demand_ext_pillar had a flaw where it might not clear the self.ext attribute (containing the pillar configuration) even if it deemed the configuration invalid. This could potentially allow the unvalidated data to persist and be used.

The patch addresses these issues by:

Introducing strict URL validation in salt.utils.gitfs.GitFS.init_remotes using a new URLValidator from salt.utils.verify.
Ensuring that salt.pillar.Pillar.__valid_on_demand_ext_pillar clears self.ext upon validation failure.

Runtime indicators during exploitation would likely involve these functions in a stack trace. Specifically, a profiler might show salt.master.AESFuncs._pillar calling into the pillar system, which then invokes salt.utils.gitfs.GitFS.init_remotes where the unvalidated URL was processed by git commands.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.