A bug has been identified in which permission changes in Azure AD are not reflected to users while they are logged in the Rancher UI. This would cause the users to retain their previous permissions in Rancher, even if they change groups on Azure AD, for example, to a lower privileged group, or are removed from a group, thus retaining their access to Rancher instead of losing it.

Impact This issue only affects Rancher instances with Azure AD integration enabled, regardless of the automatically refreshing settings which are enabled by default. The users that obtained a token (or kubeconfig) to access Rancher through the following sessions are affected by this issue: 1) Users using the Rancher UI. 2) Users using kubectl based on a kubeconfig downloaded through the Rancher UI. 3) Tokens created via the Rancher UI Create API Key feature.

Note that the permission caching is persisted even when the Rancher Manager pod is restarted. The only way for a user to get the new permissions is to logout and login again.

Patches Patched versions include releases 2.6.13, 2.7.4 and later versions.

For more information If you have any questions or comments about this advisory:

- Reach out to the SUSE Rancher Security team for security related inquiries. - Open an issue in the Rancher repository. - Verify with our support matrix and product support lifecycle.

A Missing Authorization vulnerability in of SUSE Rancher allows authenticated user to create an unauthorized shell pod and kubectl access in the local cluster This issue affects: SUSE Rancher Rancher versions prior to 2.5.17; Rancher versions prior to 2.6.10; Rancher versions prior to 2.7.1.

A Insufficient Entropy vulnerability in SUSE Rancher allows attackers that gained knowledge of the cattle-token to continue abusing this even after the token was renewed. This issue affects: SUSE Rancher Rancher versions prior to 2.6.10; Rancher versions prior to 2.7.1.

A Cleartext Storage of Sensitive Information vulnerability in SUSE Rancher allows users on managed clusters to gain access to credentials. The impact depends on the credentials exposed This issue affects: SUSE Rancher Rancher versions prior to 2.5.17; Rancher versions prior to 2.6.10; Rancher versions prior to 2.7.1.

A Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in SUSE Rancher allows code execution for user with the ability to add an untrusted Helm catalog or modifying the URL configuration used to download KDM (only admin users by default) This issue affects: SUSE Rancher Rancher versions prior to 2.5.17; Rancher versions prior to 2.6.10; Rancher versions prior to 2.7.1.

Impact

A vulnerability has been identified which enables Standard users or above to elevate their permissions to Administrator in the local cluster.

The local cluster means the cluster where Rancher is installed. It is named local inside the list of clusters in the Rancher UI.

Standard users could leverage their existing permissions to manipulate Kubernetes secrets in the local cluster, resulting in the secret being deleted, but their read-level permissions to the secret being preserved. When this operation was followed-up by other specially crafted commands, it could result in the user gaining access to tokens belonging to service accounts in the local cluster.

Users that have custom global roles which grant create and delete permissions on secrets would also be able to exploit this vulnerability.

Users with audit logs enabled in Rancher can try to identify possible abuses of this issue by going through the logs. To sieve through the data filter by kind: Secret with type: provisioning.cattle.io/cloud-credential, then investigate all log entries that affect that specific resource. A secondary check would be to filter by all operations with Opaque Secrets within the cattle-global-data namespace.

After patching, it is recommended that users review access methods to Rancher (including RBAC policies, tokens, and host-level node access), to ensure that no changes were made to persist access to users who have leveraged this vulnerability.

Patches

Patched versions include releases 2.6.13, 2.7.4 and later versions.

Workarounds

There is no direct mitigation besides updating Rancher to a patched version.

For more information

If you have any questions or comments about this advisory:

- Reach out to the SUSE Rancher Security team for security related inquiries. - Open an issue in the Rancher repository. - Verify with our support matrix and product support lifecycle.

Impact Multiple Cross-Site Scripting (XSS) vulnerabilities have been identified in the Rancher UI. Cross-Site scripting allows a malicious user to inject code that is executed within another user's browser, allowing the attacker to steal sensitive information, manipulate web content, or perform other malicious activities on behalf of the victims. This could result in a user with write access to the affected areas being able to act on behalf of an administrator, once an administrator opens the affected web page.

The affected areas include the Projects/Namespaces and Auth Provider sections. The attacker needs to be authenticated and have write access to those features in order to exploit the vulnerabilities. Some of the permissions (roles) required are:

- Project Owner. - Restricted Admin. - Configure Authentication. - Administrator. - Custom RBAC Role that provides write access on Projects or External Authentication Providers.

For users that suspect this vulnerability may have targeted their Rancher instance, we recommend rotating all API Keys and Kubeconfig tokens.

It's also advised to review logs and possibly rotate credentials stored as secrets in Rancher and downstream cluster, if you believe that users' credentials to access Rancher and its clusters might have been compromised.

Patches Patched versions include releases 2.6.13, 2.7.4 and later versions.

Workarounds There is no direct mitigation besides updating Rancher to a patched version.

Credits We would like to recognize and thank @bybit-sec for the responsible disclosure of this security issue.

For more information If you have any questions or comments about this advisory:

- Reach out to the SUSE Rancher Security team for security related inquiries. - Open an issue in the Rancher repository. - Verify with our support matrix and product support lifecycle.

Impact A vulnerability was identified in which users with update privileges on a namespace, can move that namespace into a project they don't have access to. After the namespace transfer is completed, their previous permissions are still preserved, which enables them to gain access to project-specific resources (such as project secrets). In addition, resources in the namespace will now count toward the quota limit of the new project, potentially causing availability issues.

User with roles Project Owner and Project Member on the source project can exploit this vulnerability; however, this would also apply to custom roles with similar privileges.

The patched version include an improved RBAC mechanism, which checks if the user has the correct permissions before the namespace move takes place.

Patches Patched versions include releases 2.6.13, 2.7.4 and later versions.

Workarounds There is no direct mitigation besides updating Rancher to a patched version.

For more information If you have any questions or comments about this advisory:

- Reach out to the SUSE Rancher Security team for security related inquiries. - Open an issue in the Rancher repository. - Verify with our support matrix and product support lifecycle.

Impact

A vulnerability has been identified which may lead to sensitive data being leaked into Rancher's audit logs. Rancher Audit Logging is an opt-in feature, only deployments that have it enabled and have AUDITLEVEL set to 1 or above are impacted by this issue.

The leaks might be caught in the audit logs upon these actions:

- Creating cloud credentials or new authentication providers. It is crucial to note that all authentication providers (such as AzureAD) and cloud providers (such as Google) are impacted. - Downloading a kubeconfig file from a downstream or a local cluster. - Logging in/out from Rancher.

The affected data may include the following:

- HTTP headers

Field | Location -- | -- X-Api-Auth-Header | Request header X-Api-Set-Cookie-Header | Response header X-Amz-Security-Token | Request header credentials | Request body applicationSecret | Request Body oauthCredential | Request Body serviceAccountCredential | Request Body spKey | Request Body spCert | Request body spCert | Response body certificate | Request body privateKey | Request body - API Server calls returning Secret objects (including sub-types, such as kubernetes.io/dockerconfigjson). - Raw command lines used by agents to connect to the Rancher server which expose sensitive information (e.g. register ... --token abc). - Kubeconfig contents when the 'Download KubeConfig' feature is used in the Rancher UI.

The patched versions will redact the sensitive data, replacing it with [redacted], making it safer for consumption. It is recommended that static secrets are rotated after the system is patched, to limit the potential impact of sensitive data being misused due to this vulnerability.

Note: 1. The severity of the vulnerability is intricately tied to the logging strategy employed. If logs are kept locally (default configuration), the impact is contained within the system, limiting the exposure. However, when logs are shipped to an external endpoint, the vulnerability's severity might increase, as resistance against leaks is contingent on the security measures implemented at the external log collector level. 2. The final impact severity for confidentiality, integrity and availability is dependent on the permissions that the leaked credentials have on their own services.

Patches Patched versions include releases 2.6.14, 2.7.10 and 2.8.2.

Workarounds If AUDITLEVEL 1 or above is required and you cannot update to a patched Rancher version, ensure that the log is handled appropriately and it is not shared with other users or shipped into a log ingestion solution without the appropriate RBAC enforcement. Otherwise, disabling the Audit feature or decreasing it to the audit level 0, mitigates the issue.

For more information

If you have any questions or comments about this advisory:

- Reach out to the SUSE Rancher Security team for security related inquiries. - Open an issue in the Rancher repository. - Verify with our support matrix and product support lifecycle.