CVE-2023-32198: XSS
First published: Fri Apr 25 2025(Updated: )
### Impact A vulnerability has been identified in Steve where by default it was using an insecure option that did not validate the certificate presented by the remote server while performing a TLS connection. This could allow the execution of a man-in-the-middle (MitM) attack against services using Steve. For example, Rancher relies on Steve as a dependency for its user interface (UI) to proxy requests to Kubernetes clusters. Users who have the permission to create a service in Rancher’s local cluster can take over Rancher’s UI and display their own UI to gather sensitive information. This is only possible when the setting `ui-offline-preferred` is manually set to `remote` (by default Rancher sets it to `dynamic`). This enables further attacks such as cross-site scripting (XSS), or tampering the UI to collect passwords from other users etc. Please consult the associated [MITRE ATT&CK - Technique - Adversary-in-the-Middle](https://attack.mitre.org/techniques/T1557/) for further information about this category of attack. ### Patches Patched versions of Steve include releases `v0.2.1`, `v0.3.3`, `v0.4.4` and `v0.5.13`. This vulnerability is addressed by changing Steve to always verify a server’s certificate based on Go’s TLS settings. ### Workarounds If you can't upgrade to a fixed version, please make sure that you are only using Steve to connect to trusted servers. ### References If you have any questions or comments about this advisory: - Reach out to the [SUSE Rancher Security team](https://github.com/rancher/rancher/security/policy) for security related inquiries. - Open an issue in the [Rancher](https://github.com/rancher/rancher/issues/new/choose) repository. - Verify with our [support matrix](https://www.suse.com/suse-rancher/support-matrix/all-supported-versions/) and [product support lifecycle](https://www.suse.com/lifecycle/).
| Affected Software | Affected Version | How to fix |
|---|---|---|
| go/github.com/rancher/steve | >=0.5.0<0.5.13 | 0.5.13 |
| go/github.com/rancher/steve | >=0.4.0<0.4.4 | 0.4.4 |
| go/github.com/rancher/stev | >=0.3.0<0.3.3 | 0.3.3 |
| go/github.com/rancher/steve | >=0.2.0<0.2.1 | 0.2.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2023-32198?
CVE-2023-32198 has been classified as a high severity vulnerability due to its potential to allow man-in-the-middle (MitM) attacks.
How do I fix CVE-2023-32198?
To fix CVE-2023-32198, upgrade to Steve version 0.5.14 or later, or 0.4.5 or later, depending on your installed version.
Which versions of Steve are affected by CVE-2023-32198?
The affected versions of Steve are 0.5.0 to 0.5.13, 0.4.0 to 0.4.4, 0.3.0 to 0.3.3, and 0.2.0 to 0.2.1.
What type of attack does CVE-2023-32198 allow?
CVE-2023-32198 allows for man-in-the-middle (MitM) attacks by not validating the certificate in a TLS connection.
Is there a workaround for CVE-2023-32198?
There is no official workaround for CVE-2023-32198; the only mitigation is to upgrade to a secure version of Steve.
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-95fc-g4gj-mqmx
- alias/CVE-2023-32198
- agent/software-canonical-lookup
- agent/severity
- agent/references
- agent/source
- agent/weakness
- agent/last-modified-date
- agent/type
- agent/description
- agent/first-publish-date
- agent/softwarecombine
- agent/tags
- agent/event
- package-manager/go