{"uuid": "d61f5347-6d13-4076-afc9-036d9860b1ce", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-25282", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/saltstack_salt_wheel_async_rce.rb", "content": "{\"aliases\": [], \"arch\": \"cmd, x86, x64\", \"author\": [\"Alex Seymour\", \"Christophe De La Fuente\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module leverages an authentication bypass and directory\\n          traversal vulnerabilities in Saltstack Salt's REST API to execute\\n          commands remotely on the `master` as the root user.\\n\\n          Every 60 seconds, `salt-master` service performs a maintenance\\n          process check that reloads and executes all the `grains` on the\\n          `master`, including custom grain modules in the Extension Module\\n          directory. So, this module simply creates a Python script at this\\n          location and waits for it to be executed. The time interval is set to\\n          60 seconds by default but can be changed in the `master`\\n          configuration file with the `loop_interval` option. Note that, if an\\n          administrator executes commands locally on the `master`, the\\n          maintenance process check will also be performed.\\n\\n          It has been fixed in the following installation packages: 3002.5,\\n          3001.6 and 3000.8.\\n\\n          Also, a patch is available for the following versions: 3002.2,\\n          3001.4, 3000.6, 2019.2.8, 2019.2.5, 2018.3.5, 2017.7.8, 2016.11.10,\\n          2016.11.6, 2016.11.5, 2016.11.3, 2016.3.8, 2016.3.6, 2016.3.4,\\n          2015.8.13 and 2015.8.10.\\n\\n          This module has been tested successfully against versions 3001.4,\\n          3002 and 3002.2 on Ubuntu 18.04.\", \"disclosure_date\": \"2021-02-25\", \"fullname\": \"exploit/linux/http/saltstack_salt_wheel_async_rce\", \"is_install_path\": true, \"mod_time\": \"2025-12-17 17:11:13 +0000\", \"name\": \"SaltStack Salt API Unauthenticated RCE through wheel_async client\", \"needs_cleanup\": true, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/linux/http/saltstack_salt_wheel_async_rce.rb\", \"platform\": \"Linux,Unix\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"linux/http/saltstack_salt_wheel_async_rce\", \"references\": [\"CVE-2021-25281\", \"CVE-2021-25282\", \"URL-https://saltproject.io/security_announcements/active-saltstack-cve-release-2021-feb-25/\", \"URL-https://github.com/Immersive-Labs-Sec/CVE-2021-25281/blob/main/cve-2021-25281.py\"], \"rport\": 8000, \"session_types\": false, \"targets\": [\"Unix Command\", \"Linux Dropper\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:48:54.961391Z"}