CVE-2022-22967

Vulnerability

Overview CVE-2022-22967 is an authentication bypass vulnerability in SaltStack Salt versions prior to 3002.9, 3003.5, and 3004.2 [1]. The issue lies in the PAM (Pluggable Authentication Modules) authentication mechanism, which fails to properly check the account lock status. When a user's account is locked (e.g., due to failed login attempts or administrative action), the PAM auth module still allows that user to execute Salt commands if they have an active session or authenticate via salt-api using PAM eauth [1][2].

Exploitation

An attacker who previously had valid credentials and whose account has been subsequently locked can continue to run Salt commands without re-authentication. This affects both local shell accounts with an existing session and remote salt-api users that authenticate through PAM eauth [1]. The attack requires that the user already had authorized access before the lock, and the account lock is not enforced by the PAM module. No additional privileges are needed beyond the existing session or API token [2].

Impact

Successful exploitation allows a locked-out user to maintain access to Salt's management capabilities, potentially executing arbitrary commands on managed minions, modifying configurations, or exfiltrating data. This undermines account lockout policies and can lead to unauthorized persistent access within the infrastructure [1][2].

Mitigation

The vulnerability is fixed in Salt versions 3002.9, 3003.5, and 3004.2 [1]. Users should upgrade to these or later versions. There is no known workaround; upgrading is the recommended action. The issue is not listed in CISA's Known Exploited Vulnerabilities catalog as of the publication date [2].