CVE-2021-36776: Steve API proxy impersonation
Impact
A flaw discovered in Rancher versions from 2.5.0 up to and including 2.5.9 allows an authenticated user to impersonate any user on a cluster through the Steve API proxy, without requiring knowledge of the impersonated user's credentials. This is due to the Steve API proxy not dropping the impersonation header before sending the request to the Kubernetes API. A malicious user with authenticated access to Rancher could use this to impersonate another user with administrator access in Rancher, receiving, then, administrator level access in the cluster.
Patches Patched versions include releases 2.5.10, 2.6.0 and later versions.
Workarounds Limit access in Rancher to trusted users. There is not a direct mitigation besides upgrading to the patched Rancher versions.
For more information If you have any questions or comments about this advisory: Reach out to SUSE Rancher Security team for security related inquiries. Open an issue in Rancher repository. Verify our support matrix and product support lifecycle.
Other sources
A Improper Access Control vulnerability in SUSE Rancher allows remote attackers impersonate arbitrary users. This issue affects: SUSE Rancher Rancher versions prior to 2.5.10.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-36776?
CVE-2021-36776 is considered to be a high severity vulnerability due to its potential for user impersonation.
How do I fix CVE-2021-36776?
To mitigate CVE-2021-36776, upgrade to Rancher version 2.5.10 or later.
What versions are affected by CVE-2021-36776?
Rancher versions from 2.5.0 to 2.5.9 are affected by CVE-2021-36776.
Who can exploit CVE-2021-36776?
Any authenticated user with access to the Rancher cluster can exploit CVE-2021-36776.
What components are involved in CVE-2021-36776?
CVE-2021-36776 involves the Steve API proxy within Rancher.