CVE-2024-22231: Directory creation by malicious user in saltstack

June 27, 2024

Syndic cache directory creation is vulnerable to a directory traversal attack in salt project which can lead a malicious attacker to create an arbitrary directory on a Salt master.

References

github.com/advisories/GHSA-q27c-j6j9-53w3
github.com/saltstack/salt
github.com/saltstack/salt/commit/e0cdb80b55123f4a024759ffcf2b3f0e0788e7ab
nvd.nist.gov/vuln/detail/CVE-2024-22231
saltproject.io/security-announcements/2024-01-31-advisory

Code Behaviors & Features

Detect and mitigate CVE-2024-22231 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →