CVE-2020-16846: SaltStack Shell Injection

id: CVE-2020-16846

info:
  name: SaltStack Shell Injection
  author: dwisiswant0
  severity: critical
  description: |-
    An issue was discovered in SaltStack Salt through 3002. Sending crafted web requests to the Salt API, with the SSH client enabled, can result in shell injection.
  reference:
    - https://mp.weixin.qq.com/s/R8qw_lWizGyeJS0jOcYXag
    - https://github.com/vulhub/vulhub/tree/master/saltstack/CVE-2020-16846
    - https://nvd.nist.gov/vuln/detail/CVE-2020-16846
  tags: cve,cve2020,saltstack,injection
  created: 2024/04/18

rules:
  r0:
    request:
      method: POST
      path: /run
      body: token=1337&client=ssh&tgt=*&fun=a&roster=projectdiscovery&ssh_priv=afrog
    expression: response.status == 500 && response.headers["content-type"].icontains("application/json") && response.body.bcontains(b'An unexpected error occurred')
expression: r0()