CVE-2024-22232

What it actually does

A specially crafted URL triggers directory traversal in the Salt file server, allowing a low-privileged authenticated user to read arbitrary files from the Salt master filesystem with high confidentiality impact across trust boundaries.

Why it matters to the business

Attackers can obtain sensitive configuration files, credentials, or secrets stored on the central management server, potentially enabling lateral movement or further attacks on managed systems.

How an attack unfolds

An attacker with low-privileged access to the Salt file server endpoint crafts a URL containing path traversal sequences that bypass sanitization, causing the server to serve files outside the intended root directory such as /etc/passwd or private key material.

How to fix it

Upgrade secrets-store-csi-driver-provider-aws (Chainguard) and secrets-store-csi-driver-provider-aws (Wolfi) to version 0.3.9-r2 or later; restrict network access to the Salt file server and enforce least-privilege file server roots where possible.

How to confirm the fix worked

Confirm package versions meet or exceed 0.3.9-r2; test that crafted traversal URLs no longer return file contents outside the designated directory.

Typical attack path

1. Locate an exposed Salt file server endpoint
2. Craft a URL containing sequences such as ../ or %2e%2e%2f targeting a desired file path
3. Send the request with valid low-privilege authentication
4. Receive the contents of the arbitrary file in the server response

How to detect it

Inspect Salt file server access logs and any fronting web server logs for requests containing repeated ../ sequences, encoded traversal payloads, or unexpected access to files outside normal content roots.

• URL paths containing ../ or %2e%2e%2f targeting the Salt file server
• Log entries showing file reads from paths such as /etc/ or /root/ via the file server endpoint

What your security team should do

• Apply the fixed package versions immediately on all affected deployments
• Limit exposure of the Salt file server to only trusted networks and clients
• Review and tighten file server root configurations to the minimum required paths
• Add monitoring for path traversal patterns in Salt file server request logs