How to perform getshell Reproduction of combined vulnerabilities of CVE-2020-11651 and CVE-2020-11652

How to perform CVE-2020-11651 and CVE-2020-11652 combination of vulnerabilities getshell reproduction, many novices are not very clear about this, in order to help you solve this problem, the following editor will explain for you in detail, people with this need can come to learn, I hope you can gain something.

I. brief introduction

SaltStack is a set of configuration management tool based on Python. It is a centralized management platform for server infrastructure. It has the functions of configuration management, remote execution, monitoring and so on.

Second, vulnerability description

CVE-2020-11651 SaltStack horizontal privilege bypass vulnerability. In the CVE-2020-11651 authentication bypass vulnerability, attackers can bypass the verification logic of Salt Master and call relevant unauthorized functions by constructing malicious requests, thus creating remote command execution vulnerabilities.

CVE-2020-11652 SaltStack directory traversal vulnerability, attackers can take advantage of this directory traversal vulnerability combined with CVE-2020-11651 vulnerability to read arbitrary files and obtain system sensitive information.

III. Scope of influence

Vulnerability impact

SaltStack

< 2019.2.4 SaltStack < 3000.2 四、环境搭建 这两个漏洞可以在vulhub中找到对应的docker。 Docker-compose up -d 开启docker容器 五、漏洞复现 下载地址：https://github.com/bravery9/SaltStack-Exp

Read a file

Command execution

Listen on the port on the remote server

Python3-m http.server 8002

Rebound shell

Attack aircraft listening port

VI. Loophole defense

Update SaltStack version

Is it helpful for you to read the above content? If you want to know more about the relevant knowledge or read more related articles, please follow the industry information channel, thank you for your support.