Authentication Downgrade in Salt Enables Minion Impersonation

Executive Summary

This vulnerability is an authentication protocol version downgrade weakness in Salt. It allows a malicious minion to bypass newer authentication and security features by using an older request payload format. This enables the attacker to impersonate a minion and circumvent protections that were introduced to address previous security issues. [1]

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can impact you by allowing a malicious minion to impersonate legitimate minions, bypassing enhanced authentication and security features. This could lead to unauthorized access, data compromise, or manipulation of Salt-managed systems, potentially undermining the integrity and security of your infrastructure. [1]

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade Salt to version 3007.9 or later, which includes a security fix for CVE-2025-62349. After upgrading the master, configure the `minimum_auth_version` option in the master configuration to enforce a minimum authentication protocol version of 3 or higher. If you have older minions that do not support protocol version 3, temporarily set `minimum_auth_version: 0` before upgrading the master, then upgrade all minions, and finally remove this override to enforce the new minimum version. [1]

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, you should check the Salt master configuration for the 'minimum_auth_version' setting. If it is not set to 3 or higher, your system may be vulnerable to authentication protocol version downgrade attacks. There are no specific commands provided in the resources to detect exploit attempts on the network or system. However, verifying the configuration can be done by inspecting the Salt master config file, typically located at /etc/salt/master, for the 'minimum_auth_version' parameter. Setting 'minimum_auth_version: 3' enforces the use of authentication protocol version 3 or higher, mitigating the vulnerability. If you have older minions, you may temporarily set 'minimum_auth_version: 0' during upgrades. No direct network detection commands or signatures are provided in the available resources. [1]

Useful 0 Not Useful 0