CVE-2020-28243: 
Python vulnerability analysis and mitigation

A command injection vulnerability (CVE-2020-28243) was discovered in SaltStack Salt before version 3002.5. The vulnerability exists in the minion's restartcheck functionality, which is vulnerable to command injection via a crafted process name. This allows for local privilege escalation by any user able to create files on the minion in a non-blacklisted directory. The vulnerability was discovered in November 2020 and was patched in February 2021 (Stealthcopter Blog, NVD).

The vulnerability exists in the restartcheck.py file where subprocess.Popen is called with shell=True and a command that can be manipulated by an attacker. The vulnerability is triggered when a process has a filehandler open to a file with a filename that ends in (deleted), and this file needs to reside in a directory that is not explicitly forbidden. The attack can be executed by crafting a malicious process name containing bash control characters such as ; | && which allows for command injection when the master calls restartcheck. The vulnerability has a CVSS v3.1 Base Score of 7.8 (HIGH) with vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (NVD, Stealthcopter Blog).

The vulnerability allows local users to escalate privileges to root on affected systems. Additionally, it could potentially be used for container escape as containerized processes are listed on the host machine, enabling command execution as root on the host machine from within a container. Under certain circumstances, there is also potential for unprivileged remote code execution (Stealthcopter Blog).

The vulnerability is exploitable by any local user who can create files in non-blacklisted directories on a minion system. The exploit requires creating a process with a specially crafted name containing command injection payloads and having an open file handler that ends with (deleted). Public proof-of-concept exploit code is available that demonstrates the vulnerability (Github Exploit).

The primary mitigation is to upgrade SaltStack Salt to version 3002.5 or later. Multiple Linux distributions have released security updates to address this vulnerability, including Debian, Fedora, and Gentoo. For Debian 9 (stretch), the fix is included in version 2016.11.2+ds-1+deb9u7, for Fedora 33 in version 3002.5-1.fc33, and for Gentoo in version 3000.8 (Debian Advisory, Fedora Update, Gentoo Advisory).