GHSA-95fc-g4gj-mqmx: XSS
First published: Fri Apr 25 2025(Updated: )
### Impact A vulnerability has been identified in Steve where by default it was using an insecure option that did not validate the certificate presented by the remote server while performing a TLS connection. This could allow the execution of a man-in-the-middle (MitM) attack against services using Steve. For example, Rancher relies on Steve as a dependency for its user interface (UI) to proxy requests to Kubernetes clusters. Users who have the permission to create a service in Rancher’s local cluster can take over Rancher’s UI and display their own UI to gather sensitive information. This is only possible when the setting `ui-offline-preferred` is manually set to `remote` (by default Rancher sets it to `dynamic`). This enables further attacks such as cross-site scripting (XSS), or tampering the UI to collect passwords from other users etc. Please consult the associated [MITRE ATT&CK - Technique - Adversary-in-the-Middle](https://attack.mitre.org/techniques/T1557/) for further information about this category of attack. ### Patches Patched versions of Steve include releases `v0.2.1`, `v0.3.3`, `v0.4.4` and `v0.5.13`. This vulnerability is addressed by changing Steve to always verify a server’s certificate based on Go’s TLS settings. ### Workarounds If you can't upgrade to a fixed version, please make sure that you are only using Steve to connect to trusted servers. ### References If you have any questions or comments about this advisory: - Reach out to the [SUSE Rancher Security team](https://github.com/rancher/rancher/security/policy) for security related inquiries. - Open an issue in the [Rancher](https://github.com/rancher/rancher/issues/new/choose) repository. - Verify with our [support matrix](https://www.suse.com/suse-rancher/support-matrix/all-supported-versions/) and [product support lifecycle](https://www.suse.com/lifecycle/).
| Affected Software | Affected Version | How to fix |
|---|---|---|
| go/github.com/rancher/steve | >=0.5.0<0.5.13 | 0.5.13 |
| go/github.com/rancher/steve | >=0.4.0<0.4.4 | 0.4.4 |
| go/github.com/rancher/stev | >=0.3.0<0.3.3 | 0.3.3 |
| go/github.com/rancher/steve | >=0.2.0<0.2.1 | 0.2.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of GHSA-95fc-g4gj-mqmx?
GHSA-95fc-g4gj-mqmx is classified as a high-severity vulnerability due to its potential to facilitate man-in-the-middle attacks.
How do I fix GHSA-95fc-g4gj-mqmx?
To fix GHSA-95fc-g4gj-mqmx, upgrade to Steve version 0.5.13, 0.4.4, 0.3.3, or 0.2.1 as recommended.
What versions of Steve are affected by GHSA-95fc-g4gj-mqmx?
GHSA-95fc-g4gj-mqmx affects Steve versions between 0.2.0 and 0.5.13 excluding the fixed versions.
What types of attacks can GHSA-95fc-g4gj-mqmx enable?
GHSA-95fc-g4gj-mqmx can enable man-in-the-middle (MitM) attacks on TLS connections due to insecure certificate validation.
Is there a patch available for GHSA-95fc-g4gj-mqmx?
Yes, patching is available by upgrading to the specified secure versions of Steve.
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-95fc-g4gj-mqmx
- alias/CVE-2023-32198
- agent/software-canonical-lookup
- agent/severity
- agent/references
- agent/source
- agent/weakness
- agent/last-modified-date
- agent/type
- agent/description
- agent/first-publish-date
- agent/softwarecombine
- agent/tags
- agent/event
- package-manager/go