Critical Vulnerability in Data Centre Configuration Tool Gives “Full Remote Command Execution"

guest · Apr 30, 2020

Critical Vulnerability in Data Centre Configuration Tool Gives “Full Remote Command Execution as Root"
April 30, 2020
https://www.cbronline.com/cybersecurity/threats/salt-vulnerability-f-secure/

Two critical vulnerabilities in the software of the open source Salt project have been awarded the highest possible CVSS score of 10 — with security company F-Secure today warning that “we expect that any competent hacker will be able to create 100 percent reliable exploits for these issues in under 24 hours.”

The “Salt” management framework by the company SaltStack is widely used as a configuration tool to manage servers in data centres, including in cloud environments. The vulnerabilities, in Salt master versions 3001 and earlier, were patched yesterday by SaltStack, but F-Secure has warned that over 6,000 instances of this service are exposed to the public Internet and likely not configured to automatically update the salt software packages.
Click to expand...

Salt Vulnerability: What’s Happened?
The vulnerabilities described in this advisory allow an attacker who can connect to the “request server” port to bypass all authentication and authorisation controls, ultimately gaining full remote command execution as root.
The vulnerabilities have been allocated CVE-2020-11651 and CVE-2020-11652.

F-Secure said: “Adding network security controls that restrict access to the salt master (ports 4505 and 4506 being the defaults)… or at least block the wider Internet, would also be prudent as the authentication and authorisation controls provided by Salt are not currently robust enough to be exposed to hostile networks.”
Salt’s guidance already recommends that Salt masters are not connected to the public internet.
Click to expand...

F-Secure said it is not releasing a proof-of-concept in order to reduce risk for those slow to patch. The company added: “We will leave exploitation as an exercise for the reader.”
Click to expand...

guest · May 3, 2020

Hackers breach LineageOS servers via unpatched vulnerability
LineageOS source code, OS builds, and signing keys were unaffected, developers said
May 3, 2020
https://www.zdnet.com/article/hackers-breach-lineageos-servers-via-unpatched-vulnerability/

Hackers have gained access to the core infrastructure of LineageOS, a mobile operating system based on Android, used for smartphones, tablets, and set-top boxes.

The intrusion took place last night, on Saturday, at around 8 pm (US Pacific coast), and was detected before the attackers could do any harm, the LineageOS team said in a statement published less than three hours after the incident.
The LineageOS team said the operating system's source code was unaffected, and so were any operating system builds, which had been already paused since April 30, because of an unrelated issue.
Click to expand...

LineageOS developers said the hack took place after the attacker used an unpatched vulnerability to breach its Salt installation.
Earlier this week, cyber-security firm F-Secure disclosed two major vulnerabilities in the Salt framework that could be used to take over Salt installations.

The two vulnerabilities were CVE-2020-11651 (an authentication bypass) and CVE-2020-11652 (a directory traversal), which, when combined, could allow attackers to bypass login procedures and run code on Salt master servers left exposed on the internet.
Click to expand...

guest · May 3, 2020

Ghost blogging platform servers hacked and infected with crypto-miner
...same vulnerability that allowed hackers to breach LineageOS servers hours before
May 3, 2020
https://www.zdnet.com/article/ghost-blogging-platform-servers-hacked-and-infected-with-crypto-miner/

A serious hacking campaign is currently underway, and tens of companies have been hacked already, ZDNet has learned from security researchers keeping an eye on the attacks.

For the past 24 hours, hackers have been mass-scanning the internet for Salt, a type of software used to manage and automate servers inside data centers, cloud server clusters, and enterprise networks.
Attackers have been exploiting two recently-patched bugs to gain access to Salt servers and then deploy a cryptocurrency miner.
LINEAGEOS HACKED. NOW GHOST.
Earlier today, ZDNet reported that hackers managed to breach the servers of LineageOS, a mobile operating system.

A second major hack surfaced a few hours later after our initial report. The second victim is Ghost, a Node.js-based blogging platform, built and advertised as a simpler alternative to WordPress.
Click to expand...

In a status page, the Ghost developer team said they detected an intrusion into their backend infrastructure systems at around 1:30am UTC.
Ghost devs said the hackers used CVE-2020-11651 (an authentication bypass) and CVE-2020-11652 (a directory traversal) to take control over its Salt master server.

Similar to LineageOS, Ghost devs took down all servers, patched systems, and redeployed everything online after a few hours.
Click to expand...

guest · May 4, 2020

one more victim (DigiCert)
Recent Salt Vulnerabilities Exploited to Hack LineageOS, Ghost, DigiCert Servers
May 4, 2020
https://www.securityweek.com/recent...ploited-hack-lineageos-ghost-digicert-servers

Managed by SaltStack, Salt is an open-source configuration tool to monitor and update the state of servers in both datacenters and cloud environments. Called minions, agents installed on servers connect to a master to deliver state reports (to a “request server”) and receive updates (from a “publish server”).

Over the weekend, attacks looking to exploit the two security flaws were observed, with LineageOS, Ghost, and DigiCert being among the first to fall victim.
Servers of the LineageOS Android distribution were hit on Saturday, May 2 [...] Open-source publishing platform Ghost revealed on its status page that attackers managed to gain access to its infrastructure on May 3.

“There is no direct evidence that private customer data, passwords or other information has been compromised. All sessions, passwords and keys are being cycled and all servers are being re-provisioned,” Ghost noted.
Click to expand...

Certificate authority DigiCert admitted on Sunday that attackers were able to exploit the Salt vulnerability and compromise the CT (Certificate Transparency) Log 2's key used to sign SCTs (signed certificate timestamps).

Other CT logs run on separate infrastructure and were unaffected, Jeremy Rowley, DigiCert Executive VP of Product, revealed. He also noted that the compromised key might not have been used to sign SCTs, as the attacker did not appear to realize they accessed the keys.

“Digging into our logs, I think the log should be distrusted for everything after 17:00:02 on May 2. This was the last known good treehead,” Rowley said a couple of hours later.
Click to expand...

guest · May 6, 2020

Search provider Algolia discloses security incident due to Salt vulnerability
Algolia now joins the ranks of LineageOS, Ghost, Digicert, and Xen Orchestra
May 6, 2020
https://www.zdnet.com/article/searc...-security-incident-due-to-salt-vulnerability/

Search service Algolia said it suffered a security breach over the weekend after hackers exploited a well-known vulnerability in the Salt server configuration software to gain access to its infrastructure.
The company said the hackers installed a backdoor and a cryptocurrency miner on a small number of its servers, but that the incident did not impact its operations in any significant way.

"While recovering the servers one by one, our main concern was to accurately evaluate what was the exact scale of the attack. [...] Analyzing the payloads executed by the malware, we concluded that the only goal of the attack was to mine crypto-currencies, and not to collect, alter, destroy or damage data," Julien Lemoine, Co-founder & CTO at Algolia.
ATTACKS ON SALT SERVERS CONTINUE
In a post-mortem report published on Tuesday, Algolia said the hack took place on Sunday, May 3, at 3:12am, Paris time.

The time of the attack matches with other security breaches reported by LineageOS, Ghost, Digicert, Xen Orchestra, and many other smaller companies (via this GitHub thread).
Click to expand...

A source in the cyber-security community told ZDNet on Sunday that the operators of the Kinsing botnet were the first threat actor to weaponize two vulnerabilities disclosed last week in Salt, a remote server configuration tool used in data centers, large corporate networks, and cloud setups.

The two vulnerabilities -- CVE-2020-11651 (an authentication bypass) and CVE-2020-11652 (a directory traversal) -- allowed the Kinsing (H2Miner) botnet crew to automate attacks on a massive scale and take over large server clusters.
Click to expand...

guest · May 11, 2020

VMware to Patch Recent Salt Vulnerabilities in vROps
May 11, 2020
https://www.securityweek.com/vmware-patch-recent-salt-vulnerabilities-vrops

Researchers discovered recently that the configuration management and orchestration system Salt is affected by serious vulnerabilities that can be exploited for authentication bypass (CVE-2020-11651) and directory traversal (CVE-2020-11652).

VMware says the Application Remote Collector (ARC) functionality introduced in vROps 7.5 uses Salt. The virtualization giant has assigned a critical severity rating to the authentication bypass flaw and an important severity rating to the directory traversal issue.

“CVE-2020-11651 (Authentication Bypass) may allow a malicious actor with network access to port 4505 or 4506 on the ARC to take control of the ARC and any Virtual Machines the ARC may have deployed a Telegraf agent to. CVE-2020-11652 (Directory Traversal) may allow a malicious actor with network access to port 4505 or 4506 on the ARC to access the entirety of the ARC filesystem,” the company said in its advisory.
The company says the vulnerabilities affect vROps 8.1.0, 8.0.x and 7.5.0, and patches “are forthcoming.” In the meantime, VMware has provided workarounds that can be implemented as a temporary solution.
Click to expand...

guest · May 28, 2020

Cisco discloses security breach that impacted VIRL-PE infrastructure
Hackers used vulnerabilities in the SaltStack data center software to breach six Cisco servers
May 28, 2020
https://www.zdnet.com/article/cisco-discloses-security-breach-that-impacted-virl-pe-infrastructure/

Cisco has disclosed today a security breach that impacted a small part of its backend infrastructure.

In a security alert published today, Cisco said that hackers used a vulnerability in the SaltStack software package, which Cisco bundles with some products, to gain access to six servers:

"Cisco identified that the Cisco maintained salt-master servers that are servicing Cisco VIRL-PE releases 1.2 and 1.3 were compromised," the company said today.
Cisco said it patched and remediated all hacked VIRL-PE servers on May 7, when it deployed updates for the SaltStack software.
Click to expand...

The two SaltStack vulnerabilities -- CVE-2020-11651 (an authentication bypass) and CVE-2020-11652 (a directory traversal) -- have been disclosed on April 30, and have been heavily abused over the past month.

Security breaches caused by the two have been reported by mobile operating system vendor LineageOS, blogging platform Ghost, certificate authority Digicert, cloud software provider Xen Orchestra, and search provider Algolia.
In most of the past incidents, victims said the hacker breached SaltStack servers and installed a cryptocurrency miner. Cisco did not elaborate on the nature of its breach.
Click to expand...

guest · May 31, 2020

mood said: ↑

Cisco discloses security breach that impacted VIRL-PE infrastructure May 28, 2020
Click to expand...

Cisco Announces Patches to SaltStack
May 29, 2020
https://www.darkreading.com/vulnera...announces-patches-to-saltstack/d/d-id/1337954

Cisco recently patched vulnerabilities in its SaltStack Framework after Salt master servers were compromised. The pair of vulnerabilities, CVE-2020-11651 and CVE-2020-11652, were discovered and patched by the Salt community, which found some 6,000 Salt masters globally that were affected. The vulnerabilities have been given a Common Vulnerability Scoring System (CVSS) score of 10, indicating that they are critical.

Cisco Modeling Labs Corporate Edition (CML) and Cisco Virtual Internet Routing Lab Personal Edition (VIRL-PE) incorporate a version of SaltStack that is running the Salt master service that is affected by these vulnerabilities.
Click to expand...

Cisco Releases Security Updates for CML and VIRL-PE

Cisco has released security updates to address SaltStack FrameWork vulnerabilities in Cisco Modeling Labs Corporate Edition (CML) and Virtual Internet Routing Lab Personal Edition (VIRL-PE). A remote attacker could exploit these vulnerabilities to take control of an affected system.
The Cybersecurity and Infrastructure Security Agency (CISA) encourages users and administrators to review the Cisco Security Advisory and apply the necessary updates or workaround.
Click to expand...

guest · Nov 3, 2020

SaltStack reveals new critical vulnerabilities, patch now
November 3, 2020
https://www.bleepingcomputer.com/ne...veals-new-critical-vulnerabilities-patch-now/

SaltStack, a VMware-owned company, has revealed critical vulnerabilities impacting Salt versions 3002 and prior, with patches available as of today.
Users are therefore encouraged to patch their Salt instances immediately.
From shell injection to authentication bypass
The three vulnerabilities disclosed today are as follows, with their severity mentioned in the respective parentheses:

CVE-2020-16846 (High/Critical) has been described by the Salt team as a shell injection vulnerability [...]

CVE-2020-25592 (High/Critical) is an authentication bypass flaw but the fix published for the same additionally mentions yet another mysterious identifier, CVE-2020-16804.

CVE-2020-17490 (Low) concerns a permissions issue, rather the access mode, when opening/saving cryptographic private key files.

Click to expand...

Confusing disclosure timeline
While the vulnerabilities were disclosed today, it is worth noting that fixes for all three vulnerabilities were committed and disclosed to GitHub much earlier.

For example, the fix for CVE-2020-16846 was pushed to GitHub as early as August 18th, and the Salt client test cases for the shell injection flaw also mention multiple Zero-Day Initiative (ZDI) IDs, such as ZDI-CAN-11143. The date of the original report on this identifier, however, is June 2020 as shown below.
The November 3rd advisory does attribute the discovery of CVE-2020-16846 and CVE-2020-17490 to KPC of Trend Micro Zero Day Initiative who had reported multiple ZDI vulnerabilities in June 2020.

It is not clear why SaltStack published the CVEs and fixes publicly to GitHub before publicly disclosing them as this could have been abused by threat actors to create exploits.
Click to expand...

guest · Nov 25, 2020

Detailing SaltStack Salt Command Injection Vulnerabilities
November 24, 2020
https://www.zerodayinitiative.com/b...tstack-salt-command-injection-vulnerabilities

On November 03, SaltStack released a security patch for Salt to fix three critical vulnerabilities. Two of these fixes were in response to five bugs originally reported through the ZDI program. These bugs can be used to achieve unauthenticated command injection on a system running the affected Salt application. ZDI-CAN-11143 was reported to the ZDI program by an anonymous researcher, while the remaining bugs are variants of ZDI-CAN-11143 discovered by me.

In this blog, we will look into the root cause of these bugs.
Click to expand...

Log in or Sign up

Critical Vulnerability in Data Centre Configuration Tool Gives “Full Remote Command Execution"

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Critical Vulnerability in Data Centre Configuration Tool Gives “Full Remote Command Execution"

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches