CVE-2020-11652 is a path traversal vulnerability in SaltStack Salt. CISA added it to the Known Exploited Vulnerabilities catalogue on 3 November 2021, which means attackers have used it in real attacks. SaltStack Salt contains a path traversal vulnerability in the salt-master process ClearFuncs which allows directory access to authenticated users.
What the vulnerability is
SaltStack Salt path traversal is an access-control flaw in the salt-master process ClearFuncs, where authenticated users can reach directories they should not be able to browse. Path traversal matters because it breaks the boundary between intended request handling and filesystem access, which can expose configuration, secrets, or execution paths.
For the canonical record and versioning details, use the CVE Program entry and the NIST National Vulnerability Database record rather than relying on secondary summaries.
Why path traversal in SaltStack Salt is dangerous
In a configuration and orchestration platform, filesystem access can be more powerful than it looks. A traversal flaw may reveal job templates, master configuration, logs, authentication material, or other files that help an attacker understand the environment and move toward broader compromise.
Because the affected component is the master-side process, the risk is not limited to a single host or user session. A successful abuse path can turn a narrow directory-access issue into a foothold for deeper administrative exposure, especially where the master stores operational state or sensitive automation material.
This is why traversal bugs in infrastructure tooling are often treated as high-value exposure points, even when the initial primitive appears limited.
How organisations assess exposure and containment
Start with an asset inventory that identifies every SaltStack Salt deployment, especially any internet-reachable or externally managed salt-master instance. Then compare that inventory to the vendor advisory and the KEV listing to confirm whether the vulnerable component is present in your environment and whether it is still exposed to real-world exploitation.
The most useful question is not only whether Salt is installed, but whether the master process is reachable by untrusted networks, whether authentication boundaries are weak, and whether the instance holds credentials or automation artifacts that would matter if directory access were abused. The NIST Cybersecurity Framework 2.0 is a useful lens for this inventory, protect, detect and recover workflow.
When direct exposure exists, organisations should treat the instance as a priority remediation target rather than a routine maintenance item. If patch timing is constrained, reduce reachability, restrict administrative networks, and harden monitoring around the master process and its filesystem access patterns.
Detection, remediation, and post-exploitation review
After patching, review whether the system may already have been accessed. Traversal exploitation often leaves little obvious noise, so detection should focus on unusual file access, unexpected master-side requests, and changes to configuration, keys, or job definitions that do not match approved change control.
Where a compromise is suspected, validate not only the Salt master itself but also any credentials, tokens, certificates, or automation secrets that the instance could have exposed. If the master mediated access to other systems, rotate the related secrets and review downstream administrative activity, because the practical impact may extend beyond the original host.
For broader vulnerability triage and verification discipline, the Vulnerability Management Guide is a useful companion for prioritising remediation, confirming exposure, and closing the loop after patching. For filesystem abuse patterns more generally, see the Web Application Attacks Guide.
Risk and Threat Considerations
Path traversal becomes especially risky in a privileged management plane because the attacker is not trying to break into a random web page, they are trying to reach files that influence administration, trust, or future execution. In practice, that can expose operational data, enable reconnaissance, or support follow-on compromise if the retrieved content includes secrets or control-plane material.
Failure mechanism: The flaw lets an authenticated user escape the intended directory boundary and request filesystem locations the master process should not disclose. That weakens the assumption that authentication alone is enough to keep sensitive files segregated.
Impact: If abused, the result can be exposure of sensitive files, escalation of insight into the environment, and a clearer path to administrative compromise or lateral movement through the systems Salt manages.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0, CIS Controls v8, OWASP ASVS and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | ID.AM-01 — Physical devices and systems within the organisation are inventoried | Salt masters must be inventoried to determine exposure to the CVE |
| PR.AA-01 — Identities and credentials are issued, managed, verified, revoked, and audited | Directory traversal can expose credentials or secret-bearing files that need lifecycle review | |
| PR.PS-01 — Configuration management is performed to ensure systems are configured according to policy | Hardening and containment of the master process are central to limiting exploitation | |
| Recommendation — Inventory every SaltStack Salt instance and flag any exposed salt-master deployments. Review and rotate any credentials, tokens, or certificates the master could have exposed. Harden the master, restrict reachability, and validate configuration against policy. | ||
| MITRE ATT&CK | T1006 — Path Traversal | The term is a direct path traversal vulnerability and maps to this technique |
| Recommendation — Map alerts and hunt logic to path traversal behaviour on the salt-master process. | ||
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | KEV-listed exploitable vulnerabilities require prioritised discovery and remediation |
| Recommendation — Prioritise this CVE in vulnerability management and verify remediation against the KEV listing. | ||
| OWASP ASVS | V5 — File Handling | The core flaw is unsafe filesystem access through directory traversal |
| Recommendation — Review file-handling checks so requests cannot escape the intended directory scope. | ||
| NIST SP 800-53 Rev 5 | SI-10 — Information Input Validation | Traversal flaws arise when inputs are not constrained before filesystem use |
| Recommendation — Validate path input before any filesystem access occurs. | ||
Practitioner Guidance
Why practitioners should care: Treat master-side directory traversal as a control-plane issue, not just an application bug. In systems like SaltStack Salt, filesystem exposure can translate directly into operational privilege and secret exposure, so remediation should be prioritised alongside authentication and access-control issues.
What to watch for: Watch for unexpected file access patterns, odd requests against the master process, and any post-event changes to configuration, credentials, or orchestration state. If compromise is suspected, review the broader management plane rather than only the vulnerable endpoint.
Practitioner takeaway: The most important question after discovery is whether the master ever held material secrets or privileged automation paths, because that determines how far the exposure can spread.