Salt Project Directory Traversal Vulnerability in Master Cache Directory

A directory traversal vulnerability has been identified in the Salt Project, specifically in version 3006.12 of the software. This vulnerability allows arbitrary files to be written to the master cache directory. The issue arises in the 'recv_file' method, where improper validation of file paths can be exploited to traverse directories and manipulate files outside of the intended directory structure.

Impact

Exploitation of this vulnerability could lead to unauthorized file writes in the master cache directory, potentially allowing for manipulation of cached data or execution of malicious payloads.

Remediation

Users can upgrade to Salt version 3007.4, which addresses this vulnerability.