CVE-2021-31999: Rancher: Privilege escalation vulnerability via malicious Connection header
A Reliance on Untrusted Inputs in a Security Decision vulnerability in Rancher allows users in the cluster to act as others users in the cluster by forging the "Impersonate-User" or "Impersonate-Group" headers. This issue affects: Rancher versions prior to 2.5.9. Rancher versions prior to 2.4.16.
Other sources
A vulnerability was discovered in Rancher 2.0.0 through the aforementioned patched versions, where a malicious Rancher user could craft an API request directed at the proxy for the Kubernetes API of a managed cluster to gain access to information they do not have access to. This is done by passing the "Impersonate-User" or "Impersonate-Group" header in the Connection header, which is then correctly removed by the proxy. At this point, instead of impersonating the user and their permissions, the request will act as if it was from the Rancher management server and incorrectly return the information. The vulnerability is limited to valid Rancher users with some level of permissions on the cluster. There is not a direct mitigation besides upgrading to the patched Rancher versions.
— GitHub
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-31999?
CVE-2021-31999 is classified as a critical vulnerability that allows users in a Rancher cluster to impersonate other users.
How do I fix CVE-2021-31999?
To fix CVE-2021-31999, upgrade your Rancher installation to version 2.5.9 or later for 2.5.x versions or to version 2.4.16 or later for 2.4.x versions.
Which versions of Rancher are affected by CVE-2021-31999?
Rancher versions prior to 2.5.9 and 2.4.16 are affected by CVE-2021-31999.
What types of attacks can CVE-2021-31999 enable?
CVE-2021-31999 can enable attackers to perform unauthorized actions by impersonating other users within the Rancher cluster.
Is there a known mitigation for CVE-2021-31999?
The only known mitigation for CVE-2021-31999 is to upgrade to the fixed versions provided by Rancher.