[BUG] ReDoS in salt-master
Open
Nobody has claimed this yet.
bug
needs-triage
- Dominant language
- Python
- Stars
- 15.7k
- Forks
- 5.6k
- Avg merge
- 2d 44m
- Merged PRs (30d)
- 80
Description
Description
when use a fake salt-minion connect salt-master, and edit some special words in /etc/salt/grains file, can attact master with redos injection
Setup
- edit those words into /etc/salt/grains
test: aaaaaaaaaaaaaaaaaaaaaaaaaaaa+ - restart salt-minion
- use a fake salt-minion client and sent req to master
Steps to Reproduce the behavior
(Include debug logs if possible and relevant)
Expected behavior
Screenshots
Versions Report
3006.5
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the report on Salt 3006.5 with the /etc/salt/grains value aaaaaaaaaaaaaaaaaaaaaaaaaaaa+, a restarted salt-minion, and a fake minion request to salt-master. Trace the request handling that processes the grains value and confirm that the fix prevents excessive regular-expression processing or master unresponsiveness.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- backend, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100