Days after cybersecurity researchers sounded the alarm over two critical vulnerabilities in the SaltStack configuration framework, a hacking campaign has already begun exploiting the flaws to breach servers of LineageOS, Ghost, and DigiCert.
Tracked as CVE-2020-11651 and CVE-2020-11652, the disclosed flaws could allow an adversary to execute arbitrary code on remote servers deployed in data centers and cloud environments. The issues were fixed by SaltStack in a release published on April 29th.
“We expect that any competent hacker will be able to create 100% reliable exploits for these issues in under 24 hours,” F-Secure researchers had previously warned in an advisory last week.
LineageOS, a maker of an open-source operating system based on Android, said it detected the intrusion on May 2nd at around 8 pm Pacific Time.
“Around 8 pm PST on May 2nd, 2020, an attacker used a CVE in our SaltStack master to gain access to our infrastructure,” the company noted in its incident report but added Android builds and signing keys were unaffected by the breach.
Ghost, a Node.js based blogging platform, also fell victim to the same flaw. In its status page, the developers noted that “around…
http://feedproxy.google.com/~r/TheHackersNews/~3/BCdT47YgINk/saltstack-rce-exploit.html