CVE-2021-25281 — AI Deep Analysis Summary

🚨 **Essence**: SaltStack Salt < 3002.5 has an **Authorization Issue**. The `salt-api` ignores `eauth` credentials for the `wheel_async` client.…

🛡️ **Root Cause**: **Missing Access Control**. The system fails to verify authentication credentials (`eauth`) for specific API endpoints (`wheel_async`).…

📦 **Affected**: **SaltStack Salt** versions **before 3002.5**. <br>🔧 **Component**: Specifically the **salt-api** service and the **wheel_async** client interface.…

👑 **Privileges**: Attackers gain **unauthenticated remote execution**. <br>📂 **Data/Action**: Can run **any wheel module** on the master.…

🔓 **Threshold**: **LOW**. <br>🔑 **Auth**: **No authentication required**. The vulnerability explicitly states `salt-api` does not honor `eauth` credentials. <br>⚙️ **Config**: Exploitable if the API is accessible.…

🔥 **Public Exp?**: **YES**. <br>📂 **PoCs**: Available on GitHub (e.g., `Immersive-Labs-Sec/CVE-2021-25281`). <br>🔍 **Tools**: Integrated into **Nuclei templates** (`projectdiscovery/nuclei-templates`).…

🔍 **Self-Check**: <br>1. Check Salt version: Is it **< 3002.5**? <br>2. Scan for `salt-api` endpoints. <br>3. Use Nuclei template: `http/cves/2021/CVE-2021-25281.yaml`. <br>4.…

✅ **Fixed?**: **YES**. <br>🛠️ **Patch**: Upgrade to SaltStack Salt **version 3002.5 or later**. <br>📢 **Advisory**: Vendor (SaltStack) and distributors (Fedora, Gentoo) have released fixes and advisories.

🚧 **No Patch?**: <br>1. **Block Access**: Restrict `salt-api` access via Firewall/WAF (only allow trusted IPs). <br>2.…

🚨 **Urgency**: **CRITICAL**. <br>⚡ **Priority**: **Immediate Action Required**. <br>📉 **Risk**: High impact (RCE) + Low exploitation difficulty (No Auth).…