T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- references/active_finger.json:2730
- Finding
- Fleet-Wide SaltStack Command Dispatched by an Active Fingerprint Probe<![CDATA[ ## Vulnerability Details **File Location**: `references/active_finger.json:2730-2743` **Vulnerability Type**: Active command execution beyond the minimum requirements of service fingerprinting **Risk Level**: High ### Vulnerable Code ```json { "cms": "SaltStack", "path": "/run", "method": "POST", "headers": { "Accept": [ "application/json" ], "Content-Type": [ "application/json" ] }, "body": "{\"client\": \"local\", \"tgt\": \"*\", \"fun\": \"test.ping\"}", "match": { "status_code": [ 200 ], "keyword": [ "return", "test.ping" ], "location": "body", "match_type": "keyword" } } ``` ### Technical Analysis This fingerprint performs a `POST` request against the Salt API `/run` endpoint and requests execution through the `local` client. The target expression is the wildcard `*`, which represents every minion managed by the reachable Salt master. Although `test.ping` is generally non-destructive, this is an orchestration command rather than a read-only service-identification request. If the endpoint is exposed or improperly authenticated, the probe can cause a job to be dispatched across the entire managed fleet. This violates least privilege because identifying a SaltStack interface does not require executing a function on all managed systems. The rule also lacks a per-rule authorization gate, target restriction, or explicit confirmation before submitting the command. The documented full-scan workflow may therefore trigger the probe as part of routine fingerprinting. ### Attack Path 1. An operator or AI agent starts a full MUKI scan against an authorized web target. 2. The target exposes or proxies a Salt API at `/run`. 3. The active fingerprint rule submits a JSON request using the `local` client. 4. The wildcard target expression selects all minions connected to the Salt master. 5. The Salt master dispatches `test.ping` to those minions. 6. Returned data can reve ...[truncated 977 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the command-dispatch fingerprint and identify SaltStack through read-only characteristics such as response headers, login-page content, TLS properties, or a harmless unauthenticated metadata endpoint. 2. Never use the wildcard target expression `*` in a generic fingerprinting rule. 3. If command-based verification is indispensable, disable it by default and require a separate explicit opt-in for intrusive probes. 4. Require the operator to specify a single authorized minion rather than allowing fleet-wide selection. 5. Display the exact method, endpoint, request body, and operational scope before execution and require confirmation. 6. Enforce authentication and authorization checks before issuing any Salt API request. 7. Separate passive, read-only active, and state-changing probes into distinct risk classes. 8. Add automated policy tests that reject generic fingerprint rules containing orchestration clients, wildcard targets, or command-execution functions. ]]>