CVE-2026-103406: Juniper Session Smart Conductor RCE — Root-Level Command Injection Detection and Remediation Guide

---
title: Suspicious Shell Metacharacters in Salt Minion ID
description: Detects Salt minion registration or log entries containing shell metacharacters in the minion ID field, indicative of command injection via CVE-2026-103406.
id: 8f2a1c4e-5b3d-4e6f-9a7b-1c2d3e4f5a6b
status: experimental
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-103406
  - https://attack.mitre.org/techniques/T1059/004/
author: Security Arsenal
date: 2026/02/04
tags:
  - attack.execution
  - attack.t1059.004
  - cve.2026.103406
logsource:
  product: linux
  service: salt
detection:
  selection_metachar:
    - '|';'
    - ';'
    - '&&'
    - '||'
    - '$( '
    - '`'
    - '>'
    - '<'
  condition: selection_metachar
falsepositives:
  - Highly unusual; legitimate minion IDs should be alphanumeric with hyphens/underscores only
level: critical
---
title: Salt Master Spawning Unexpected Shell Commands
description: Detects the Salt master process (salt-master) spawning shell interpreters or command execution tools, which may indicate command injection via the AutomatedProvisioner minion ID vulnerability.
id: 3c7d9e2f-6a1b-4c8d-9e0f-2a3b4c5d6e7f
status: experimental
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-103406
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/02/04
tags:
  - attack.execution
  - attack.t1059
  - cve.2026.103406
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/salt-master'
      - '/salt'
  selection_child:
    Image|endswith:
      - '/bash'
      - '/sh'
      - '/dash'
      - '/zsh'
      - '/curl'
      - '/wget'
      - '/python'
      - '/python3'
      - '/perl'
      - '/nc'
      - '/ncat'
      - '/socat'
  condition: selection_parent and selection_child
falsepositives:
  - Salt state executions that legitimately invoke shell commands as part of configuration management
  - Juniper AutomatedProvisioner workflows that run scripts — baseline normal conductor behavior before enabling alerting
level: high
---
title: Outbound Network Connection from Salt Master Process
description: Detects the Salt master process initiating outbound network connections to external IP addresses, potentially indicating data exfiltration or C2 communication following exploitation.
id: 5e1f8a3c-7b2d-4e9f-8a1c-3d4e5f6a7b8c
status: experimental
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-103406
  - https://attack.mitre.org/techniques/T1071/
author: Security Arsenal
date: 2026/02/04
tags:
  - attack.command_and_control
  - attack.t1071
  - attack.exfiltration
  - cve.2026.103406
logsource:
  category: network_connection
  product: linux
detection:
  selection_process:
    Image|endswith:
      - '/salt-master'
      - '/salt'
  selection_external:
    DestinationIp|cidr:
      - '0.0.0.0/0'
  filter_rfc1918:
    DestinationIp|cidr:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
      - '127.0.0.0/8'
  condition: selection_process and selection_external and not filter_rfc1918
falsepositives:
  - Salt master fetching updates or external pillar data from internet-hosted sources
  - Juniper Sky Enterprise or cloud-based management callbacks
level: high

// Hunt 1: Suspicious Salt minion ID strings containing shell metacharacters in syslog
Syslog
| where TimeGenerated > ago(14d)
| where Computer has_any ("conductor", "ssr-conductor", "salt-master")
| where SyslogMessage has_any ("minion", "salt")
| where SyslogMessage matches regex @"[;|&`$(){}]"
| project TimeGenerated, Computer, ProcessName, SyslogMessage, SeverityLevel
| order by TimeGenerated desc

// Hunt 2: Shell or download tool execution under salt-master process tree
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName has_any ("salt-master", "salt")
| where FileName in~ ("bash", "sh", "dash", "zsh", "curl", "wget", "nc", "ncat", "socat", "python", "python3", "perl")
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, AccountName
| order by TimeGenerated desc

// Hunt 3: Outbound connections from conductor hosts to unusual destinations
DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName has_any ("salt-master", "salt")
| where RemoteIPType == "Public"
| summarize ConnectionCount = count(), UniqueDestinations = dcount(RemoteIP), Destinations = make_set(RemoteIP, 20) by DeviceName, InitiatingProcessFileName, bin(TimeGenerated, 1h)
| where UniqueDestinations > 3
| order by ConnectionCount desc

-- Hunt for suspicious child processes spawned by salt-master and unusual network connections
-- CVE-2026-103406: Juniper Session Smart Conductor Command Injection

LET suspicious_procs = SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Name =~ '(bash|sh|dash|zsh|curl|wget|nc|ncat|socat|python|python3|perl)'
  AND Ppid IN (
    SELECT Pid FROM pslist() WHERE Name =~ 'salt'
  )

LET salt_connections = SELECT Pid, Name, Status, Laddr, Raddr
FROM netstat()
WHERE Name =~ 'salt'
  AND Status = 'ESTABLISHED'
  AND NOT Raddr.IP =~ '^(10\\.|172\\.(1[6-9]|2[0-9]|3[01])\\.|192\\.168\\.|127\\.)'

SELECT * FROM suspicious_procs
UNION ALL
SELECT * FROM salt_connections

#!/bin/bash
# CVE-2026-103406 — Juniper Session Smart Conductor Emergency Response Script
# Run as root on Session Smart Conductor hosts
# Purpose: Identify exposure, check version, apply interim network restrictions

set -euo pipefail

echo "============================================="
echo " CVE-2026-103406 Response Script"
echo " $(date -u '+%Y-%m-%d %H:%M:%S UTC')"
echo "============================================="
echo ""

# --- Step 1: Check if Salt master is listening ---
echo "[*] Checking Salt master listener status..."
if ss -tlnp 2>/dev/null | grep -qE ':(4505|4506)\s'; then
    echo "[ALERT] Salt master ports 4505/4506 are LISTENING."
    ss -tlnp | grep -E ':(4505|4506)\s'
    SALT_EXPOSED=1
else
    echo "[OK] Salt master ports 4505/4506 are not listening."
    SALT_EXPOSED=0
fi
echo ""

# --- Step 2: Check installed SSR/Conductor version ---
echo "[*] Checking installed Session Smart software version..."
if command -v rpm &>/dev/null; then
    INSTALLED_VERSION=$(rpm -qa | grep -i '128T\|session-smart\|ssr' | head -5)
    echo "    Installed packages:"
    echo "$INSTALLED_VERSION" | while read -r line; do echo "      - $line"; done
elif command -v dpkg &>/dev/null; then
    INSTALLED_VERSION=$(dpkg -l | grep -i '128t\|session-smart\|ssr' | head -5)
    echo "    Installed packages:"
    echo "$INSTALLED_VERSION" | while read -r line; do echo "      - $line"; done
else
    echo "[!] Could not determine package manager. Check version manually."
fi
echo ""
echo "    ACTION REQUIRED: Compare installed version against Juniper advisory."
echo "    Advisory: https://supportportal.juniper.net/ (search CVE-2026-103406)"
echo ""

# --- Step 3: Check for suspicious minion IDs in Salt logs ---
echo "[*] Scanning Salt logs for suspicious minion ID patterns..."
SALT_LOG="/var/log/salt/master"
if [ -f "$SALT_LOG" ]; then
    SUSPICIOUS=$(grep -nE '[;|&`$(){}{}]' "$SALT_LOG" 2>/dev/null | grep -i 'minion\|auth\|accept\|key' | tail -20)
    if [ -n "$SUSPICIOUS" ]; then
        echo "[ALERT] Suspicious entries found in Salt master log:"
        echo "$SUSPICIOUS"
    else
        echo "[OK] No obviously suspicious minion ID entries found in recent Salt master log."
    fi
else
    echo "[!] Salt master log not found at $SALT_LOG — check logging configuration."
fi
echo ""

# --- Step 4: Interim firewall restriction (if Salt is exposed) ---
if [ "$SALT_EXPOSED" -eq 1 ]; then
    echo "[*] Applying interim iptables restrictions on Salt master ports..."
    echo "    IMPORTANT: Replace ALLOWED_SUBNET with your actual minion subnet(s)."
    echo ""
    echo "    Example commands (edit before running in production):"
    echo "      iptables -A INPUT -p tcp --dport 4505 -s 10.1.0.0/24 -j ACCEPT"
    echo "      iptables -A INPUT -p tcp --dport 4506 -s 10.1.0.0/24 -j ACCEPT"
    echo "      iptables -A INPUT -p tcp --dport 4505 -j DROP"
    echo "      iptables -A INPUT -p tcp --dport 4506 -j DROP"
    echo ""
    echo "    To make persistent: iptables-save > /etc/sysconfig/iptables"
    echo ""
    read -p "    Apply DROP rules now for non-localhost traffic on 4505/4506? (y/N): " -n 1 -r
    echo ""
    if [[ $REPLY =~ ^[Yy]$ ]]; then
        # Allow localhost first (conductor internal communication)
        iptables -C INPUT -p tcp --dport 4505 -s 127.0.0.1 -j ACCEPT 2>/dev/null || \
            iptables -I INPUT 1 -p tcp --dport 4505 -s 127.0.0.1 -j ACCEPT
        iptables -C INPUT -p tcp --dport 4506 -s 127.0.0.1 -j ACCEPT 2>/dev/null || \
            iptables -I INPUT 1 -p tcp --dport 4506 -s 127.0.0.1 -j ACCEPT

        # Drop everything else on Salt ports
        iptables -C INPUT -p tcp --dport 4505 -j DROP 2>/dev/null || \
            iptables -A INPUT -p tcp --dport 4505 -j DROP
        iptables -C INPUT -p tcp --dport 4506 -j DROP 2>/dev/null || \
            iptables -A INPUT -p tcp --dport 4506 -j DROP

        echo "[DONE] DROP rules applied. Add explicit ACCEPT rules for minion subnets above the DROP."
        iptables -L INPUT -n --line-numbers | grep -E '4505|4506'
    else
        echo "[SKIP] Firewall rules not applied. Manual intervention required."
    fi
fi

echo ""
echo "============================================="
echo " NEXT STEPS:"
echo " 1. Apply Juniper patch immediately (see advisory)."
echo " 2. Restrict Salt ports 4505/4506 to known minion subnets only."
echo " 3. Audit Salt accepted keys: salt-key -L"
echo " 4. Review /var/log/salt/master for unauthorized minion registrations."
echo " 5. Hunt for post-exploitation artifacts (see detection queries)."
echo "============================================="