Impact
This vulnerability only affects customers using Weave CNI (Container Network Interface) when configured through RKE templates.
A flaw was discovered in Rancher versions from 2.5.0 up to and including 2.5.13 and from 2.6.0 up to and including 2.6.4, where a UI (user interface) issue with RKE templates does not include a value for the Weave password when Weave is chosen as the CNI.
If a cluster is created based on the mentioned template and Weave is configured as the CNI, no password will be created for network encryption in Weave, therefore network traffic in the cluster will be sent unencrypted.
This issue does not happen when a cluster, with Weave configured as CNI, is created without using an RKE template.
The impact of this vulnerability is higher when nodes on the cluster are on different locations and communicate with one another through the Internet, where monitoring (sniffing) of the network traffic by third-party entities can be more easily achieved.
Patches
Patched versions include releases 2.5.14, 2.6.5 and later versions of Rancher. Besides upgrading to a Rancher patched version, the workarounds listed below must be applied in order for Weave to properly encrypt the network traffic.
Workarounds
1. A manual password can be set in Weave by directly editing Weave's DaemonSet on the affected cluster to add the WEAVEPASSWORD environment variable together with the a value for the password.
shell $ kubectl -n kube-system edit ds weave-net yaml <snipped> containers: - command: - /home/weave/launch.sh env: - name: INITCONTAINER value: "true" - name: HOSTNAME valueFrom: fieldRef: apiVersion: v1 fieldPath: spec.nodeName - name: IPALLOCRANGE value: <IP allocation range> - name: WEAVEPASSWORD value: "insert strong secret password here" image: <Weave image> <snipped> 2. A new RKE template revision must be created in order to properly generate the Weave password on new clusters.
Notes
1. In order to provide protection against brute-force attacks, that might break the network encryption, a strong password must be generated for the workaround. Weave's documentation provides recommendations for generating a strong password.
2. Manually generating the password for the workaround is only needed on affected versions of Rancher. This step is not needed when creating new RKE templates on patched versions of Rancher.
For more information
If you have any questions or comments about this advisory:
Reach out to SUSE Rancher Security team for security related inquiries. Open an issue in Rancher repository. Verify SUSE Rancher support matrix and product support lifecycle.
Impact
An issue was discovered in Rancher versions up to and including 2.5.15 and 2.6.6 where a flaw with authorization logic allows privilege escalation through cluster role template binding (CRTB) and project role template binding (PRTB). This issue does not affect the local cluster, it affects only downstream clusters.
The vulnerability can be exploited by any user who has permissions to create/edit cluster role template bindings or project role template bindings (such as cluster-owner, manage cluster members, project-owner and manage project members) to gain owner permission in another project in the same cluster or in another project on a different downstream cluster.
- The user must have kubectl access in the local cluster to exploit this scenario.
- This can only be abused to gain cluster-owner permission on a different downstream cluster if the user is already cluster-owner on at least one downstream cluster.
- Example of a modified CRTB (note: the clusterName points to the cluster ID of the cluster that the privileges will be escalated and namespace points to the current cluster ID that the user has permissions): kubectl edit clusterroletemplatebindings crtb-<crtb-ID> -n c-<cluster-ID> --- apiVersion: management.cattle.io/v3 clusterName: <ID-of-the-cluster-to-escalate> kind: ClusterRoleTemplateBinding metadata: annotations: <omitted> finalizers: - <omitted> generateName: crtb- labels: <omitted> cattle.io/creator: norman name: crtb-<crtb-ID> namespace: c-<current-cluster-ID> roleTemplateName: cluster-owner userName: u-<user-ID> userPrincipalName: local://u-<user-ID>
An artifact to flag the exploitation of this issue is that the namespace of the CRTB/PRTB will not match the cluster name (clusterName) of the CRTB/PRTB. For example, every CRTB in the c-123xyz namespace should have a cluster name of c-123xyz. If instead, the cluster name is c-abc567, for example, this is likely a result of a user exploiting this flaw.
For more information about cluster and project roles, please consult Rancher's documentation.
Patches
Patched versions include releases 2.5.16, 2.6.7 and later versions.
Workarounds
Limit access in Rancher to trusted users. There is not a direct mitigation besides upgrading to the patched Rancher versions.
Important: - It is highly advised to check the local and downstream clusters for potential unrecognized CRTBs (kubectl get clusterroletemplatebindings -A) and PRTBs (kubectl get projectroletemplatebindings -A) assignments. - The ability to add other users to projects and clusters is a highly-privileged permission which may result in users being able to operate beyond their explicitly specified RBAC. It is recommended that this permission be granted selectively.
The following script can be used as a helper to detect possible deviations of CRTBs and PRTBs that do not match the expected value. Further investigation is required to determine if the flagged objects were maliciously modified or not. The script requires kubectl access to the local cluster and the jq command.
shell #!/usr/bin/env bash
echo "CRTBs that don't match cluster:" kubectl get clusterroletemplatebindings -A -o=jsonpath="{range .items[?(@.clusterName!=@.metadata.namespace)]}{.metadata.name}{'\n'}{end}"
echo "PRTBs that don't match project:" kubectl get projectroletemplatebindings -A -ojson | jq -r '.items[]|.metadata as $m|select(.projectName|endswith($m.namespace)|not)|.metadata.name'
For more information
If you have any questions or comments about this advisory:
Reach out to SUSE Rancher Security team for security related inquiries. Open an issue in Rancher repository. Verify our support matrix and product support lifecycle.
Impact
It was discovered that in Rancher versions up to and including 2.5.12 and 2.6.3 there is a failure to properly sanitize credentials in cluster template answers. This failure can lead to plaintext storage and exposure of credentials, passwords and API tokens.
The exposed credentials are visible in Rancher to authenticated Cluster Owners, Cluster Members, Project Owners and Project Members on the endpoints /v1/management.cattle.io.clusters, /v3/clusters and /k8s/clusters/local/apis/management.cattle.io/v3/clusters.
Sensitive fields are now stripped from Clusters objects before the object is stored. For objects that existed before this security fix, a one-time migration happens on startup.
Important: - It is highly advised to review for potential leaked credentials in this scenario, and to change them if deemed necessary. - The final impact severity for confidentiality, integrity and availability is dependent on the permissions that the leaked credentials have on their own services.
Patches Patched versions include releases 2.5.13, 2.6.4 and later versions.
Workarounds Limit access in Rancher to trusted users. There is not a direct mitigation besides upgrading to the patched Rancher versions.
Important: It is highly advised to review for potential leaked credentials in this scenario, and to change them if deemed necessary.
For more information If you have any questions or comments about this advisory: Reach out to SUSE Rancher Security team for security related inquiries. Open an issue in Rancher repository. Verify our support matrix and product support lifecycle.
Impact
A failure in the update logic of Rancher's admission Webhook may lead to the misconfiguration of the Webhook. This component enforces validation rules and security checks before resources are admitted into the Kubernetes cluster.
When the Webhook is operating in a degraded state, it no longer validates any resources, which may result in severe privilege escalations and data corruption.
The issue only affects users that upgrade from 2.6.x or 2.7.x to 2.7.2. Users that did a fresh install of 2.7.2 (and did not follow an upgrade path) are not affected.
The command below can be executed on the local cluster to determine whether the cluster is affected by this issue:
sh $ kubectl get validatingwebhookconfigurations.admissionregistration.k8s.io rancher.cattle.io
NAME WEBHOOKS AGE rancher.cattle.io 0 19h
If the resulting webhook quantity is 0, the Rancher instance is affected.
Patches
Patched versions include release 2.7.3 and later versions.
Workarounds
If you are affected and cannot update to a patched Rancher version, the recommended workaround is to manually reconfigure the Webhook with the script below. Please note that the script must be run from inside the local cluster or with a kubeconfig pointing to the local cluster which has admin permissions.
yaml #!/bin/bash
set -euo pipefail
function prereqs() { if ! [ -x "$(command -v kubectl)" ]; then echo "error: kubectl is not installed." >&2 exit 1 fi
if [[ -z "$(kubectl config view -o jsonpath='{.clusters[].cluster.server}')" ]]; then echo "error: No kubernetes cluster found on kubeconfig." >&2 exit 1 fi }
function restartdeployment(){ kubectl rollout restart deployment rancher-webhook -n cattle-system kubectl rollout status deployment rancher-webhook -n cattle-system --timeout=30s }
function workaround() { echo "Cluster: $(kubectl config view -o jsonpath='{.clusters[].cluster.server}')"
if ! kubectl get validatingwebhookconfigurations.admissionregistration.k8s.io rancher.cattle.io > /dev/null 2>&1; then echo "webhook rancher.cattle.io not found, restarting deployment:" restartdeployment
echo "waiting for webhook configuration" sleep 15s fi
local -i webhooks webhooks="$(kubectl get validatingwebhookconfigurations.admissionregistration.k8s.io rancher.cattle.io --no-headers | awk '{ print $2 }')"
if [ "${webhooks}" == "0" ]; then echo "Webhook misconfiguration status: Cluster is affected by CVE-2023-22651" echo "Running workaround:" kubectl delete validatingwebhookconfiguration rancher.cattle.io restartdeployment
ret=$? if [ $ret -eq 0 ]; then echo "Webhook restored, CVE-2023-22651 is fixed" else echo "error trying to restart deployment. try again in a few seconds." fi else echo "Webhook misconfiguration status: not present (skipping)" fi
echo "Done" }
function main() { prereqs workaround }
main
References - https://github.com/rancher/webhook/pull/216/commits/a4a498613b43a3ee93c5ab06742a3bc8adace45d
For more information If you have any questions or comments about this advisory:
- Reach out to the SUSE Rancher Security team for security related inquiries. - Open an issue in the Rancher repository. - Verify our support matrix and product support lifecycle.
A Missing Authorization vulnerability in of SUSE Rancher allows authenticated user to create an unauthorized shell pod and kubectl access in the local cluster This issue affects: SUSE Rancher Rancher versions prior to 2.5.17; Rancher versions prior to 2.6.10; Rancher versions prior to 2.7.1.
A Insufficient Entropy vulnerability in SUSE Rancher allows attackers that gained knowledge of the cattle-token to continue abusing this even after the token was renewed. This issue affects: SUSE Rancher Rancher versions prior to 2.6.10; Rancher versions prior to 2.7.1.
A Cleartext Storage of Sensitive Information vulnerability in SUSE Rancher allows users on managed clusters to gain access to credentials. The impact depends on the credentials exposed This issue affects: SUSE Rancher Rancher versions prior to 2.5.17; Rancher versions prior to 2.6.10; Rancher versions prior to 2.7.1.
A Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in SUSE Rancher allows code execution for user with the ability to add an untrusted Helm catalog or modifying the URL configuration used to download KDM (only admin users by default) This issue affects: SUSE Rancher Rancher versions prior to 2.5.17; Rancher versions prior to 2.6.10; Rancher versions prior to 2.7.1.
A Improper Privilege Management vulnerability in SUSE Rancher, allows users with access to the escalate verb on PRTBs to escalate permissions for any -promoted resource in any cluster. This issue affects: SUSE Rancher Rancher versions prior to 2.5.17; Rancher versions prior to 2.6.10.
Impact
A vulnerability has been identified which enables Standard users or above to elevate their permissions to Administrator in the local cluster.
The local cluster means the cluster where Rancher is installed. It is named local inside the list of clusters in the Rancher UI.
Standard users could leverage their existing permissions to manipulate Kubernetes secrets in the local cluster, resulting in the secret being deleted, but their read-level permissions to the secret being preserved. When this operation was followed-up by other specially crafted commands, it could result in the user gaining access to tokens belonging to service accounts in the local cluster.
Users that have custom global roles which grant create and delete permissions on secrets would also be able to exploit this vulnerability.
Users with audit logs enabled in Rancher can try to identify possible abuses of this issue by going through the logs. To sieve through the data filter by kind: Secret with type: provisioning.cattle.io/cloud-credential, then investigate all log entries that affect that specific resource. A secondary check would be to filter by all operations with Opaque Secrets within the cattle-global-data namespace.
After patching, it is recommended that users review access methods to Rancher (including RBAC policies, tokens, and host-level node access), to ensure that no changes were made to persist access to users who have leveraged this vulnerability.
Patches
Patched versions include releases 2.6.13, 2.7.4 and later versions.
Workarounds
There is no direct mitigation besides updating Rancher to a patched version.
For more information
If you have any questions or comments about this advisory:
- Reach out to the SUSE Rancher Security team for security related inquiries. - Open an issue in the Rancher repository. - Verify with our support matrix and product support lifecycle.
Impact Multiple Cross-Site Scripting (XSS) vulnerabilities have been identified in the Rancher UI. Cross-Site scripting allows a malicious user to inject code that is executed within another user's browser, allowing the attacker to steal sensitive information, manipulate web content, or perform other malicious activities on behalf of the victims. This could result in a user with write access to the affected areas being able to act on behalf of an administrator, once an administrator opens the affected web page.
The affected areas include the Projects/Namespaces and Auth Provider sections. The attacker needs to be authenticated and have write access to those features in order to exploit the vulnerabilities. Some of the permissions (roles) required are:
- Project Owner. - Restricted Admin. - Configure Authentication. - Administrator. - Custom RBAC Role that provides write access on Projects or External Authentication Providers.
For users that suspect this vulnerability may have targeted their Rancher instance, we recommend rotating all API Keys and Kubeconfig tokens.
It's also advised to review logs and possibly rotate credentials stored as secrets in Rancher and downstream cluster, if you believe that users' credentials to access Rancher and its clusters might have been compromised.
Patches Patched versions include releases 2.6.13, 2.7.4 and later versions.
Workarounds There is no direct mitigation besides updating Rancher to a patched version.
Credits We would like to recognize and thank @bybit-sec for the responsible disclosure of this security issue.
For more information If you have any questions or comments about this advisory:
- Reach out to the SUSE Rancher Security team for security related inquiries. - Open an issue in the Rancher repository. - Verify with our support matrix and product support lifecycle.
Impact
A vulnerability has been identified which may lead to sensitive data being leaked into Rancher's audit logs. Rancher Audit Logging is an opt-in feature, only deployments that have it enabled and have AUDITLEVEL set to 1 or above are impacted by this issue.
The leaks might be caught in the audit logs upon these actions:
- Creating cloud credentials or new authentication providers. It is crucial to note that all authentication providers (such as AzureAD) and cloud providers (such as Google) are impacted. - Downloading a kubeconfig file from a downstream or a local cluster. - Logging in/out from Rancher.
The affected data may include the following:
- HTTP headers
Field | Location -- | -- X-Api-Auth-Header | Request header X-Api-Set-Cookie-Header | Response header X-Amz-Security-Token | Request header credentials | Request body applicationSecret | Request Body oauthCredential | Request Body serviceAccountCredential | Request Body spKey | Request Body spCert | Request body spCert | Response body certificate | Request body privateKey | Request body - API Server calls returning Secret objects (including sub-types, such as kubernetes.io/dockerconfigjson). - Raw command lines used by agents to connect to the Rancher server which expose sensitive information (e.g. register ... --token abc). - Kubeconfig contents when the 'Download KubeConfig' feature is used in the Rancher UI.
The patched versions will redact the sensitive data, replacing it with [redacted], making it safer for consumption. It is recommended that static secrets are rotated after the system is patched, to limit the potential impact of sensitive data being misused due to this vulnerability.
Note: 1. The severity of the vulnerability is intricately tied to the logging strategy employed. If logs are kept locally (default configuration), the impact is contained within the system, limiting the exposure. However, when logs are shipped to an external endpoint, the vulnerability's severity might increase, as resistance against leaks is contingent on the security measures implemented at the external log collector level. 2. The final impact severity for confidentiality, integrity and availability is dependent on the permissions that the leaked credentials have on their own services.
Patches Patched versions include releases 2.6.14, 2.7.10 and 2.8.2.
Workarounds If AUDITLEVEL 1 or above is required and you cannot update to a patched Rancher version, ensure that the log is handled appropriately and it is not shared with other users or shipped into a log ingestion solution without the appropriate RBAC enforcement. Otherwise, disabling the Audit feature or decreasing it to the audit level 0, mitigates the issue.
For more information
If you have any questions or comments about this advisory:
- Reach out to the SUSE Rancher Security team for security related inquiries. - Open an issue in the Rancher repository. - Verify with our support matrix and product support lifecycle.
A Cleartext Storage of Sensitive Information vulnerability in SUSE Rancher allows authenticated Cluster Owners, Cluster Members, Project Owners, Project Members and User Base to use the Kubernetes API to retrieve plaintext version of sensitive data. This issue affects: SUSE Rancher Rancher versions prior to 2.5.16; Rancher versions prior to 2.6.7.
A Incorrect Authorization vulnerability in SUSE Rancher allows administrators of third-party repositories to gather credentials that are sent to their servers. This issue affects: SUSE Rancher Rancher versions prior to 2.5.12; Rancher versions prior to 2.6.3.
A Improper Privilege Management vulnerability in SUSE Rancher allows users with the restricted-admin role to escalate to full admin. This issue affects: SUSE Rancher Rancher versions prior to 2.5.13; Rancher versions prior to 2.6.4.
A Improper Privilege Management vulnerability in SUSE Rancher allows write access to the Catalog for any user when restricted-admin role is enabled. This issue affects: SUSE Rancher Rancher versions prior to 2.5.13; Rancher versions prior to 2.6.4.