Headline
GHSA-gvh9-xgrq-r8hw: Rancher's Steve API Component Improper authorization check allows privilege escalation
Impact
A flaw discovered in Rancher versions from 2.5.0 up to and including 2.5.9 allows an authenticated user to impersonate any user on a cluster through the Steve API proxy, without requiring knowledge of the impersonated user’s credentials. This is due to the Steve API proxy not dropping the impersonation header before sending the request to the Kubernetes API. A malicious user with authenticated access to Rancher could use this to impersonate another user with administrator access in Rancher, receiving, then, administrator level access in the cluster.
Patches
Patched versions include releases 2.5.10, 2.6.0 and later versions.
Workarounds
Limit access in Rancher to trusted users. There is not a direct mitigation besides upgrading to the patched Rancher versions.
For more information
If you have any questions or comments about this advisory:
- Reach out to SUSE Rancher Security team for security related inquiries.
- Open an issue in Rancher repository.
- Verify our support matrix and product support lifecycle.
- GitHub Advisory Database
- GitHub Reviewed
- CVE-2021-36776
Rancher’s Steve API Component Improper authorization check allows privilege escalation
High severity GitHub Reviewed Published Mar 31, 2022 in rancher/rancher • Updated Apr 24, 2024
Package
gomod github.com/rancher/rancher (Go)
Affected versions
>= 2.5.0, <= 2.5.9
Impact
A flaw discovered in Rancher versions from 2.5.0 up to and including 2.5.9 allows an authenticated user to impersonate any user on a cluster through the Steve API proxy, without requiring knowledge of the impersonated user’s credentials. This is due to the Steve API proxy not dropping the impersonation header before sending the request to the Kubernetes API. A malicious user with authenticated access to Rancher could use this to impersonate another user with administrator access in Rancher, receiving, then, administrator level access in the cluster.
Patches
Patched versions include releases 2.5.10, 2.6.0 and later versions.
Workarounds
Limit access in Rancher to trusted users. There is not a direct mitigation besides upgrading to the patched Rancher versions.
For more information
If you have any questions or comments about this advisory:
- Reach out to SUSE Rancher Security team for security related inquiries.
- Open an issue in Rancher repository.
- Verify our support matrix and product support lifecycle.
References
- https://nvd.nist.gov/vuln/detail/CVE-2021-36776
- https://bugzilla.suse.com/show_bug.cgi?id=1189413
Published to the GitHub Advisory Database
Apr 24, 2024
Last updated
Apr 24, 2024
Related news
A Improper Access Control vulnerability in SUSE Rancher allows remote attackers impersonate arbitrary users. This issue affects: SUSE Rancher Rancher versions prior to 2.5.10.