CVE-2022-22935

Vulnerability

An authentication denial of service vulnerability exists in SaltStack Salt, affecting all versions before 3002.8, 3003.4, and 3004.1 [1]. The flaw occurs during minion authentication: a man-in-the-middle (MiTM) attacker can impersonate a master and send specially crafted replies that cause the minion process to terminate. The attack targets the unsecured authentication exchange between a minion and a master [4].

Exploitation

An attacker must be positioned on the network to intercept and modify traffic between a minion and a legitimate master (i.e., a MiTM position). No authentication or prior access to the Salt environment is required. The attacker impersonates the master during the key exchange and sends a malicious authentication reply; the minion, upon receiving the forged response, stops its process. The attack does not require user interaction or special privileges beyond network proximity.

Impact

Successful exploitation causes the targeted minion process to terminate, resulting in a denial of service for that minion's managed systems. The attacker gains no code execution, data access, or persistent control; the impact is limited to service disruption. The minion can be restarted manually or via a watchdog, but the attack can be repeated.

Mitigation

Fixed versions were released on 2022-03-29: 3002.8, 3003.4, and 3004.1 [1][4]. During upgrade, all masters must be updated before minions, as older masters cannot communicate with fixed minions [4]. No workaround is available; upgrading to a patched version is required. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.