{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2020-16846/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2020-16846/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2020-16846/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2020-16846/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2020-16846/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2020-16846"},"sightings":{"href":"/api/v1/sightings/cve-2020-16846"}},"enrichments":{"cisa-kev":{"kev":true},"epss":{"epss":0.99585,"kev":true,"percentile":0.99946},"nuclei":{"nuclei":true,"nuclei_template":"http/cves/2020/CVE-2020-16846.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2020-16846\n\ninfo:\n  name: SaltStack <=3002 - Shell Injection\n  author: dwisiswant0\n  severity: critical\n  description: |\n    SaltStack Salt through 3002 allows an unauthenticated user with network access to the Salt API to use shell injections to run code on the Salt-API using the SSH client.\n  impact: |\n    Unauthenticated attackers can execute arbitrary shell commands via the Salt API, leading to complete server compromise and access to all managed systems.\n  remediation: |\n    Upgrade to a patched version of SaltStack (>=3003) to mitigate this vulnerability.\n  reference:\n    - https://saltproject.io/on-november-3-2020-saltstack-publicly-disclosed-three-new-cves/\n    - https://mp.weixin.qq.com/s/R8qw_lWizGyeJS0jOcYXag\n    - https://github.com/vulhub/vulhub/tree/master/saltstack/CVE-2020-16846\n    - https://nvd.nist.gov/vuln/detail/CVE-2020-16846\n    - http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00029.html\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2020-16846\n    cwe-id: CWE-78\n    epss-score: 0.99585\n    epss-percentile: 0.99946\n    cpe: cpe:2.3:a:saltstack:salt:*:*:*:*:*:*:*:*\n  metadata:\n    max-request: 1\n    vendor: saltstack\n    product: salt\n  tags: cve2020,cve,vulhub,saltstack,kev,vkev,vuln\nvariables:\n  priv: \"{{to_lower(rand_text_alpha(5))}}\"\n  roaster: \"{{to_lower(rand_text_alpha(6))}}\"\n\nhttp:\n  - method: POST\n    path:\n      - \"{{BaseURL}}/run\"\n\n    body: \"token=1337&client=ssh&tgt=*&fun=a&roster={{roaster}}&ssh_priv={{priv}}\"\n\n    headers:\n      Content-Type: application/x-www-form-urlencoded # CherryPy will abort w/o define this header\n\n    matchers-condition: and\n    matchers:\n      - type: dsl\n        dsl:\n          - regex(\"CherryPy\\/([0-9.]+)\", header) || regex(\"CherryPy ([0-9.]+)\", body)\n\n      - type: word\n        part: body\n        words:\n          - \"An unexpected error occurred\"\n\n      - type: word\n        part: header\n        words:\n          - \"application/json\"\n\n      - type: status\n        status:\n          - 500\n# digest: 4a0a00473045022059a9ec2c061d1e96a376c24754158f271fedae934ca8183d9f0b2f14335377f5022100ca5465375e8ae332730e17eb81a11639930c8e8a04f873532e1cb74162142d86:922c64590222798bb761d5b6d8e72950"}},"vuln_id":"cve-2020-16846"}