A SAML authentication replay vulnerability in Rancher's Assertion Consumer Service (ACS) handler did not enforce one-time use of SAML assertion, potentially allowing person in the middle attacks against Rancher, affecting Rancher 2.14.0 before 2.14.3,

Impact

A vulnerability has been identified in Rancher Manager that allows users assigned the Project Owner role to modify Pod Security Admission (PSA) labels on namespaces within their projects. Under the default role configuration, an attacker with the following access pattern can exploit this issue: 1. Cluster Access: The user is granted Cluster Member access. 2. Project Ownership: The user creates or is assigned ownership of a project. 3. Namespace Creation: The user creates a namespace within that project. 4. PSA Modification: The user modifies the namespace PSA configuration to use the privileged profile. 5. Privilege Escalation: The user deploys privileged workloads within the namespace.

As outlined in the Kubernetes Pod Security Standards documentation, privileged containers disable core Kubernetes security protections, allowing workloads to bypass standard container isolation boundaries. This can result in privilege escalation within the cluster environment.

Potential impacts include: - Deployment of privileged containers - Access to host-level resources - Container breakout - Cluster privilege escalation - Compromise of workloads running on affected nodes

Please refer to the associated MITRE ATT&CK techniques for further information about this category of attack: - Deploy Container - Escape to Host - Exploitation for Privilege Escalation

Reference: Kubernetes Pod Security Standards — Privileged Profile

Patches This vulnerability is resolved by modifying the project-owner role to explicitly define the allowed verbs for projects resources instead of using the wildcard () permission.

The updated role configuration removes access to the updatepsa verb. This prevents project owners from modifying PSA settings in a manner that could enable privilege escalation.

Patched versions of Rancher include releases v2.12.10, v2.13.6, and v2.14.2.

Workarounds If upgrading is not immediately possible, administrators should create a custom project role based on the existing Project Owner role, while removing unrestricted wildcard permissions for project resources.

The allowed verbs for projects should be restricted to: “get, update, delete, patch, create, list, watch, deletecollection” instead of “”.

This prevents access to the updatepsa capability that enables the privilege escalation path.

References If you have any questions or comments about this advisory: - Reach out to the SUSE Rancher Security team for security related inquiries. - Open an issue in the Rancher repository. - Verify with our support matrix and product support lifecycle.

Impact

An issue was discovered in Rancher versions up to and including 2.5.15 and 2.6.6 where a flaw with authorization logic allows privilege escalation through cluster role template binding (CRTB) and project role template binding (PRTB). This issue does not affect the local cluster, it affects only downstream clusters.

The vulnerability can be exploited by any user who has permissions to create/edit cluster role template bindings or project role template bindings (such as cluster-owner, manage cluster members, project-owner and manage project members) to gain owner permission in another project in the same cluster or in another project on a different downstream cluster.

- The user must have kubectl access in the local cluster to exploit this scenario.

- This can only be abused to gain cluster-owner permission on a different downstream cluster if the user is already cluster-owner on at least one downstream cluster.

- Example of a modified CRTB (note: the clusterName points to the cluster ID of the cluster that the privileges will be escalated and namespace points to the current cluster ID that the user has permissions): kubectl edit clusterroletemplatebindings crtb-<crtb-ID> -n c-<cluster-ID> --- apiVersion: management.cattle.io/v3 clusterName: <ID-of-the-cluster-to-escalate> kind: ClusterRoleTemplateBinding metadata: annotations: <omitted> finalizers: - <omitted> generateName: crtb- labels: <omitted> cattle.io/creator: norman name: crtb-<crtb-ID> namespace: c-<current-cluster-ID> roleTemplateName: cluster-owner userName: u-<user-ID> userPrincipalName: local://u-<user-ID>

An artifact to flag the exploitation of this issue is that the namespace of the CRTB/PRTB will not match the cluster name (clusterName) of the CRTB/PRTB. For example, every CRTB in the c-123xyz namespace should have a cluster name of c-123xyz. If instead, the cluster name is c-abc567, for example, this is likely a result of a user exploiting this flaw.

For more information about cluster and project roles, please consult Rancher's documentation.

Patches

Patched versions include releases 2.5.16, 2.6.7 and later versions.

Workarounds

Limit access in Rancher to trusted users. There is not a direct mitigation besides upgrading to the patched Rancher versions.

Important: - It is highly advised to check the local and downstream clusters for potential unrecognized CRTBs (kubectl get clusterroletemplatebindings -A) and PRTBs (kubectl get projectroletemplatebindings -A) assignments. - The ability to add other users to projects and clusters is a highly-privileged permission which may result in users being able to operate beyond their explicitly specified RBAC. It is recommended that this permission be granted selectively.

The following script can be used as a helper to detect possible deviations of CRTBs and PRTBs that do not match the expected value. Further investigation is required to determine if the flagged objects were maliciously modified or not. The script requires kubectl access to the local cluster and the jq command.

shell #!/usr/bin/env bash

echo "CRTBs that don't match cluster:" kubectl get clusterroletemplatebindings -A -o=jsonpath="{range .items[?(@.clusterName!=@.metadata.namespace)]}{.metadata.name}{'\n'}{end}"

echo "PRTBs that don't match project:" kubectl get projectroletemplatebindings -A -ojson | jq -r '.items[]|.metadata as $m|select(.projectName|endswith($m.namespace)|not)|.metadata.name'

For more information

If you have any questions or comments about this advisory:

Reach out to SUSE Rancher Security team for security related inquiries. Open an issue in Rancher repository. Verify our support matrix and product support lifecycle.

Impact

It was discovered that in Rancher versions up to and including 2.5.12 and 2.6.3 there is a failure to properly sanitize credentials in cluster template answers. This failure can lead to plaintext storage and exposure of credentials, passwords and API tokens.

The exposed credentials are visible in Rancher to authenticated Cluster Owners, Cluster Members, Project Owners and Project Members on the endpoints /v1/management.cattle.io.clusters, /v3/clusters and /k8s/clusters/local/apis/management.cattle.io/v3/clusters.

Sensitive fields are now stripped from Clusters objects before the object is stored. For objects that existed before this security fix, a one-time migration happens on startup.

Important: - It is highly advised to review for potential leaked credentials in this scenario, and to change them if deemed necessary. - The final impact severity for confidentiality, integrity and availability is dependent on the permissions that the leaked credentials have on their own services.

Patches Patched versions include releases 2.5.13, 2.6.4 and later versions.

Workarounds Limit access in Rancher to trusted users. There is not a direct mitigation besides upgrading to the patched Rancher versions.

Important: It is highly advised to review for potential leaked credentials in this scenario, and to change them if deemed necessary.

For more information If you have any questions or comments about this advisory: Reach out to SUSE Rancher Security team for security related inquiries. Open an issue in Rancher repository. Verify our support matrix and product support lifecycle.

Impact

A failure in the update logic of Rancher's admission Webhook may lead to the misconfiguration of the Webhook. This component enforces validation rules and security checks before resources are admitted into the Kubernetes cluster.

When the Webhook is operating in a degraded state, it no longer validates any resources, which may result in severe privilege escalations and data corruption.

The issue only affects users that upgrade from 2.6.x or 2.7.x to 2.7.2. Users that did a fresh install of 2.7.2 (and did not follow an upgrade path) are not affected.

The command below can be executed on the local cluster to determine whether the cluster is affected by this issue:

sh $ kubectl get validatingwebhookconfigurations.admissionregistration.k8s.io rancher.cattle.io

NAME WEBHOOKS AGE rancher.cattle.io 0 19h

If the resulting webhook quantity is 0, the Rancher instance is affected.

Patches

Patched versions include release 2.7.3 and later versions.

Workarounds

If you are affected and cannot update to a patched Rancher version, the recommended workaround is to manually reconfigure the Webhook with the script below. Please note that the script must be run from inside the local cluster or with a kubeconfig pointing to the local cluster which has admin permissions.

yaml #!/bin/bash

set -euo pipefail

function prereqs() { if ! [ -x "$(command -v kubectl)" ]; then echo "error: kubectl is not installed." >&2 exit 1 fi

if [[ -z "$(kubectl config view -o jsonpath='{.clusters[].cluster.server}')" ]]; then echo "error: No kubernetes cluster found on kubeconfig." >&2 exit 1 fi }

function restartdeployment(){ kubectl rollout restart deployment rancher-webhook -n cattle-system kubectl rollout status deployment rancher-webhook -n cattle-system --timeout=30s }

function workaround() { echo "Cluster: $(kubectl config view -o jsonpath='{.clusters[].cluster.server}')"

if ! kubectl get validatingwebhookconfigurations.admissionregistration.k8s.io rancher.cattle.io > /dev/null 2>&1; then echo "webhook rancher.cattle.io not found, restarting deployment:" restartdeployment

echo "waiting for webhook configuration" sleep 15s fi

local -i webhooks webhooks="$(kubectl get validatingwebhookconfigurations.admissionregistration.k8s.io rancher.cattle.io --no-headers | awk '{ print $2 }')"

if [ "${webhooks}" == "0" ]; then echo "Webhook misconfiguration status: Cluster is affected by CVE-2023-22651" echo "Running workaround:" kubectl delete validatingwebhookconfiguration rancher.cattle.io restartdeployment

ret=$? if [ $ret -eq 0 ]; then echo "Webhook restored, CVE-2023-22651 is fixed" else echo "error trying to restart deployment. try again in a few seconds." fi else echo "Webhook misconfiguration status: not present (skipping)" fi

echo "Done" }

function main() { prereqs workaround }

main

References - https://github.com/rancher/webhook/pull/216/commits/a4a498613b43a3ee93c5ab06742a3bc8adace45d

For more information If you have any questions or comments about this advisory:

- Reach out to the SUSE Rancher Security team for security related inquiries. - Open an issue in the Rancher repository. - Verify our support matrix and product support lifecycle.

A Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in wrangler of SUSE Rancher allows remote attackers to inject commands in the underlying host via crafted commands passed to Wrangler. This issue affects: SUSE Rancher wrangler version 0.7.3 and prior versions; wrangler version 0.8.4 and prior versions; wrangler version 1.0.0 and prior versions.

A Insufficient Entropy vulnerability in SUSE Rancher allows attackers that gained knowledge of the cattle-token to continue abusing this even after the token was renewed. This issue affects: SUSE Rancher Rancher versions prior to 2.6.10; Rancher versions prior to 2.7.1.

A Cleartext Storage of Sensitive Information vulnerability in SUSE Rancher allows users on managed clusters to gain access to credentials. The impact depends on the credentials exposed This issue affects: SUSE Rancher Rancher versions prior to 2.5.17; Rancher versions prior to 2.6.10; Rancher versions prior to 2.7.1.

Impact

A vulnerability has been identified which enables Standard users or above to elevate their permissions to Administrator in the local cluster.

The local cluster means the cluster where Rancher is installed. It is named local inside the list of clusters in the Rancher UI.

Standard users could leverage their existing permissions to manipulate Kubernetes secrets in the local cluster, resulting in the secret being deleted, but their read-level permissions to the secret being preserved. When this operation was followed-up by other specially crafted commands, it could result in the user gaining access to tokens belonging to service accounts in the local cluster.

Users that have custom global roles which grant create and delete permissions on secrets would also be able to exploit this vulnerability.

Users with audit logs enabled in Rancher can try to identify possible abuses of this issue by going through the logs. To sieve through the data filter by kind: Secret with type: provisioning.cattle.io/cloud-credential, then investigate all log entries that affect that specific resource. A secondary check would be to filter by all operations with Opaque Secrets within the cattle-global-data namespace.

After patching, it is recommended that users review access methods to Rancher (including RBAC policies, tokens, and host-level node access), to ensure that no changes were made to persist access to users who have leveraged this vulnerability.

Patches

Patched versions include releases 2.6.13, 2.7.4 and later versions.

Workarounds

There is no direct mitigation besides updating Rancher to a patched version.

For more information

If you have any questions or comments about this advisory:

- Reach out to the SUSE Rancher Security team for security related inquiries. - Open an issue in the Rancher repository. - Verify with our support matrix and product support lifecycle.

A Cleartext Storage of Sensitive Information vulnerability in SUSE Rancher allows authenticated Cluster Owners, Cluster Members, Project Owners, Project Members and User Base to use the Kubernetes API to retrieve plaintext version of sensitive data. This issue affects: SUSE Rancher Rancher versions prior to 2.5.16; Rancher versions prior to 2.6.7.

An issue was discovered in Rancher 2 through 2.1.5. Any project member with access to the default namespace can mount the netes-default service account in a pod, and then use that pod to execute administrative privileged commands against the k8s cluster. This could be mitigated by isolating the default namespace in a separate project, where only cluster admins can be given permissions to access. As of 2018-12-20, this bug affected ALL clusters created or imported by Rancher.

An issue was discovered that affects the following versions of Rancher: v2.0.0 through v2.0.13, v2.1.0 through v2.1.8, and v2.2.0 through 2.2.1. When Rancher starts for the first time, it creates a default admin user with a well-known password. After initial setup, the Rancher administrator may choose to delete this default admin user. If Rancher is restarted, the default admin user will be recreated with the well-known default password. An attacker could exploit this by logging in with the default admin credentials. This can be mitigated by deactivating the default admin user rather than completing deleting them.