EUVD-2025-18251
GHSA-c46w-gr7f-jm2p
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L
Lifecycle Timeline
4Tags
Description
Arbitrary event injection on Salt Master. The master's "_minion_event" method can be used by and authorized minion to send arbitrary events onto the master's event bus.
Analysis
CVE-2025-22239 is an arbitrary event injection vulnerability in SaltStack's master node that allows an authorized minion to inject malicious events onto the master's event bus via the '_minion_event' method. This affects Salt Master deployments where minions have event publishing capabilities, enabling authenticated attackers to manipulate internal event flows and potentially trigger unintended master behaviors. The CVSS 8.1 score reflects high confidentiality and integrity impact with local attack vector, though exploitation requires prior authentication as an authorized minion.
Technical Context
SaltStack (also known as Salt) is a Python-based infrastructure automation and configuration management platform that uses a master-minion architecture communicating over ZeroMQ. The vulnerability exists in the Salt Master's '_minion_event' method, which processes events published by minions onto the master's internal event bus—a critical messaging backbone used for orchestration, job tracking, and inter-component communication. The root cause is classified under CWE-285 (Improper Authorization), indicating insufficient validation of event sources and content before processing minion-submitted events. An authorized minion can craft arbitrary event payloads that the master accepts and processes without proper authorization checks, potentially allowing injection of events that trigger actions intended only for administrative or system-level sources. The event bus architecture means injected events propagate to all event listeners and reactors on the master.
Affected Products
SaltStack Salt Master (specific version range not provided in available data, but likely affects recent versions up to a patch release). CPE data would typically be: cpe:2.3:a:saltproject:salt:*:*:*:*:*:*:*:* with version constraints to be determined from vendor advisory. The vulnerability is specific to master nodes (not standalone minions), making it relevant for organizations running the 'salt-master' service. Affected configurations include any deployment where: (1) the Salt Master is running with its event bus accessible, (2) minions are registered and authenticated to the master, and (3) the '_minion_event' RPC method is enabled (likely default). No version information available; check SaltProject official advisories and release notes for specific patched versions.
Remediation
Immediate actions: (1) Disable or restrict access to the '_minion_event' RPC method if not required for your deployment (check /etc/salt/master configuration and reactor configuration), (2) Isolate Salt Master event bus access to trusted network segments, (3) Review Salt event reactor rules to identify which actions could be triggered by injected events and disable unnecessary reactors. Patch-based remediation: Update SaltStack Salt to the patched version (version number requires checking SaltProject's official CVE advisory at https://docs.saltproject.io/ or https://github.com/saltstack/salt/releases). Workarounds: (1) Implement strict input validation in custom event reactors on the master, (2) Use event ACLs or event tagging to distinguish trusted vs. minion-sourced events, (3) Monitor event bus for suspicious patterns using Salt's event logging capabilities ('salt-run state.event'), (4) Restrict minion authentication to necessary minions only and audit minion keys regularly. Long-term: Upgrade to Salt versions post-patch, review CWE-285 (improper authorization) patterns in custom Salt configurations, and implement event bus monitoring and alerting.
Priority Score
Vendor Status
Ubuntu
Priority: Medium| Release | Status | Version |
|---|---|---|
| trusty | needs-triage | - |
| xenial | needs-triage | - |
| bionic | needs-triage | - |
| jammy | needs-triage | - |
| noble | DNE | - |
| oracular | DNE | - |
| plucky | DNE | - |
| upstream | needs-triage | - |
| questing | DNE | - |
Debian
| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| (unstable) | fixed | (unfixed) | - |
Share
External POC / Exploit Code
Leaving vuln.today