CVE-2021-25318: rancher: API group not properly specified when creating Kubernetes RBAC resources
A Incorrect Permission Assignment for Critical Resource vulnerability in Rancher allows users in the cluster to modify resources they should not have access to. This issue affects: Rancher versions prior to 2.5.9 ; Rancher versions prior to 2.4.16.
Other sources
A vulnerability was discovered in Rancher versions 2.0 through the aforementioned fixed versions, where users were granted access to resources regardless of the resource's API group. For example Rancher should have allowed users access to apps.catalog.cattle.io, but instead incorrectly gave access to apps.. Resource affected include:
Downstream clusters: apiservices clusters clusterrepos persistentvolumes storageclasses
Rancher management cluster apprevisions apps catalogtemplates catalogtemplateversions clusteralertgroups clusteralertrules clustercatalogs clusterloggings clustermonitorgraphs clusterregistrationtokens clusterroletemplatebindings clusterscans etcdbackups nodepools nodes notifiers pipelineexecutions pipelines pipelinesettings podsecuritypolicytemplateprojectbindings projectalertgroups projectalertrules projectcatalogs projectloggings projectmonitorgraphs projectroletemplatebindings projects secrets sourcecodeproviderconfigs
There is not a direct mitigation besides upgrading to the patched Rancher versions.
— GitHub
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-25318?
The severity of CVE-2021-25318 is classified as high due to the improper permission assignment allowing unauthorized resource modification.
How do I fix CVE-2021-25318?
To fix CVE-2021-25318, upgrade to Rancher version 2.5.9 or 2.4.16 or later.
What versions of Rancher are affected by CVE-2021-25318?
CVE-2021-25318 affects Rancher versions prior to 2.5.9 and versions prior to 2.4.16.
What impact does CVE-2021-25318 have on my resources?
CVE-2021-25318 allows users in the cluster to modify resources they do not have authorization to access.
Is there a workaround for CVE-2021-25318?
There is no official workaround for CVE-2021-25318; upgrading to the patched versions is necessary.