CVE-2024-22231

What it actually does

The vulnerability permits a directory traversal attack during the creation of the syndic cache directory, enabling the creation of arbitrary directories on the Salt master system.

Why it matters to the business

Attackers could manipulate directory structures on the master server, potentially leading to unauthorized file system changes that disrupt operations or enable further compromise.

How an attack unfolds

An attacker with limited privileges sends a crafted request that exploits the path traversal flaw in the syndic cache directory creation process, resulting in the creation of directories outside the intended cache location on the Salt master.

How to fix it

Update the Salt project to a version that properly sanitizes directory paths during syndic cache creation.

How to confirm the fix worked

Review code changes for path sanitization in directory creation functions and test with traversal payloads.

Typical attack path

1. Identify vulnerable Salt master with syndic enabled
2. Craft malicious directory path in cache creation request
3. Send request to trigger traversal
4. Verify arbitrary directory creation

How to detect it

Examine logs for unusual directory creation attempts or paths containing traversal sequences like ../ in cache related operations.

What your security team should do

• Apply security patches promptly
• Monitor for unusual directory creations
• Restrict access to Salt master