CVE-2023-34049

What it actually does

The Salt-SSH pre-flight option copies its script to a predictable path on the target, enabling an attacker with local access and path knowledge to substitute a malicious script that executes with the privileges of the Salt-SSH user; the flaw stems from improper input validation of the copy destination combined with missing verification of scp return codes.

Why it matters to the business

Attackers who already have a foothold on managed systems can hijack Salt-SSH operations to run arbitrary code, potentially leading to full compromise of infrastructure managed by Salt and disruption of configuration and orchestration workflows.

How an attack unfolds

An attacker with access to the target VM predicts the pre-flight script path, places a malicious script at that location before Salt-SSH runs, and relies on the lack of path randomization and scp error checking so that Salt-SSH executes the attacker's script with the privileges of the invoking user.

How to fix it

Upgrade to a Salt release that uses an unpredictable path for pre-flight script copies and verifies scp return codes; if no fixed version is available, disable the pre-flight option or restrict Salt-SSH usage to trusted targets only.

How to confirm the fix worked

Review Salt-SSH source for randomized temporary paths and explicit scp return-code checks; test by attempting to place a file at the former predictable location and confirming Salt-SSH refuses or fails the operation.

Typical attack path

1. Obtain local access to the target VM
2. Determine or guess the predictable pre-flight script path used by Salt-SSH
3. Write a malicious script to that exact path
4. Trigger or wait for a Salt-SSH pre-flight operation
5. Observe execution of the malicious script under the Salt-SSH user's context

How to detect it

Search Salt master and minion logs for scp commands involving pre-flight scripts, unexpected file creations in predictable temporary paths, or executions of scripts whose content does not match known Salt-SSH pre-flight payloads.

What your security team should do

• Prioritize patching Salt to the first release containing unpredictable pre-flight paths and scp validation
• Audit Salt-SSH usage and restrict pre-flight to environments where targets are fully trusted
• Monitor for unexpected files appearing in temporary directories used by Salt-SSH
• Review logs for scp operations that complete without error checking