cve/2020/CVE-2020-11652.md

### [CVE-2020-11652](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11652)
![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brighgreen)

### Description

An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class allows access to some methods that improperly sanitize paths. These methods allow arbitrary directory access to authenticated users.

### POC

#### Reference
- http://packetstormsecurity.com/files/157560/Saltstack-3000.1-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/157678/SaltStack-Salt-Master-Minion-Unauthenticated-Remote-Code-Execution.html

#### Github
- https://github.com/0xMafty/Twiggy
- https://github.com/0xT11/CVE-POC
- https://github.com/0xc0d/CVE-2020-11651
- https://github.com/20142995/sectool
- https://github.com/5l1v3r1/SaltStack-Exp-1
- https://github.com/ARPSyndicate/cvemon
- https://github.com/Al1ex/CVE-2020-11652
- https://github.com/CVEDB/PoC-List
- https://github.com/CVEDB/awesome-cve-repo
- https://github.com/CVEDB/top
- https://github.com/CnHack3r/Penetration_PoC
- https://github.com/EchoGin404/-
- https://github.com/EchoGin404/gongkaishouji
- https://github.com/GhostTroops/TOP
- https://github.com/Imanfeng/SaltStack-Exp
- https://github.com/JERRY123S/all-poc
- https://github.com/Mr-xn/Penetration_Testing_POC
- https://github.com/Ostorlab/KEV
- https://github.com/Ostorlab/known_exploited_vulnerbilities_detectors
- https://github.com/Threekiii/Awesome-Exploit
- https://github.com/Threekiii/Awesome-POC
- https://github.com/Threekiii/Vulhub-Reproduce
- https://github.com/Tyro-Shan/gongkaishouji
- https://github.com/YIXINSHUWU/Penetration_Testing_POC
- https://github.com/ZTK-009/Penetration_PoC
- https://github.com/apachecn-archive/Middleware-Vulnerability-detection
- https://github.com/appcheck-ng/salt-rce-scanner-CVE-2020-11651-CVE-2020-11652
- https://github.com/bakery312/Vulhub-Reproduce
- https://github.com/bravery9/SaltStack-Exp
- https://github.com/chef-cft/salt-vulnerabilities
- https://github.com/cyberanand1337x/bug-bounty-2022
- https://github.com/developer3000S/PoC-in-GitHub
- https://github.com/dwoz/salt-rekey
- https://github.com/fanjq99/CVE-2020-11652
- https://github.com/ffffffff0x/Dork-Admin
- https://github.com/fofapro/vulfocus
- https://github.com/hardsoftsecurity/CVE-2020-11651-PoC
- https://github.com/hasee2018/Penetration_Testing_POC
- https://github.com/hectorgie/PoC-in-GitHub
- https://github.com/heikanet/CVE-2020-11651-CVE-2020-11652-EXP
- https://github.com/hktalent/TOP
- https://github.com/hktalent/bug-bounty
- https://github.com/huike007/penetration_poc
- https://github.com/huike007/poc
- https://github.com/jasperla/CVE-2020-11651-poc
- https://github.com/jbmihoub/all-poc
- https://github.com/kasini3000/kasini3000
- https://github.com/limon768/CVE-2020-11652-CVE-2020-11652-POC
- https://github.com/limon768/CVE-2020-11652-POC
- https://github.com/lions2012/Penetration_Testing_POC
- https://github.com/lovechinacoco/https-github.com-mai-lang-chai-Middleware-Vulnerability-detection
- https://github.com/n3masyst/n3masyst
- https://github.com/nomi-sec/PoC-in-GitHub
- https://github.com/orgTestCodacy11KRepos110MB/repo-1492-Dork-Admin
- https://github.com/password520/Penetration_PoC
- https://github.com/pentration/gongkaishouji
- https://github.com/rapyuta-robotics/clean-script
- https://github.com/rossengeorgiev/salt-security-backports
- https://github.com/soosmile/POC
- https://github.com/ssrsec/CVE-2020-11651-CVE-2020-11652-EXP
- https://github.com/tdtc7/qps
- https://github.com/trganda/dockerv
- https://github.com/trganda/starrlist
- https://github.com/weeka10/-hktalent-TOP
- https://github.com/winterwolf32/CVE-S---Penetration_Testing_POC-
- https://github.com/xuetusummer/Penetration_Testing_POC
- https://github.com/yedada-wei/-
- https://github.com/yedada-wei/gongkaishouji