VMware SALT prior 3006.12/3007.4 salt.auth.pki Password certificate validation

Summaryinfo

A vulnerability has been found in VMware SALT and classified as critical. This vulnerability affects unknown code of the component salt.auth.pki. This manipulation of the argument Password causes certificate validation. The identification of this vulnerability is CVE-2024-38825. It is possible to initiate the attack remotely. There is no exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in VMware SALT. It has been declared as critical. Affected by this vulnerability is an unknown part of the component salt.auth.pki. The manipulation of the argument password with an unknown input leads to a certificate validation vulnerability. The CWE definition for the vulnerability is CWE-295. The product does not validate, or incorrectly validates, a certificate. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

The salt.auth.pki module does not properly authenticate callers. The "password" field contains a public certificate which is validated against a CA certificate by the module. This is not pki authentication, as the caller does not need access to the corresponding private key for the authentication attempt to be accepted.

The advisory is shared at docs.saltproject.io. This vulnerability is known as CVE-2024-38825 since 06/20/2024. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details are known, but no exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 07/24/2025). MITRE ATT&CK project uses the attack technique T1587.003 for this issue.

The vulnerability scanner Nessus provides a plugin with the ID 242657 (SUSE SLES15 Security Update : salt (SUSE-SU-2025:02502-1)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 3006.12 or 3007.4 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (242657) and EUVD (EUVD-2024-54683). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• VMware

Name

• SALT

License

• commercial

Website

• Vendor: https://www.vmware.com/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion