PT-2019-13183 · Rancher · Rancher

Published 2019-09-04 · Updated 2022-04-13 · CVE-2019-13209

Positive Technologies (AI Summary)

CVSS v3.1

8.7

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions Rancher versions 2 through 2.2.4

Description The issue allows an exploiter to perform a Cross-Site Websocket Hijacking attack, gaining access to clusters managed by Rancher. This attack requires a victim to be logged into a Rancher server and then access a third-party site hosted by the exploiter. Once accomplished, the exploiter can execute commands against the cluster's Kubernetes API with the permissions and identity of the victim.

Recommendations For versions 2 through 2.2.4, update to a version later than 2.2.4 to resolve the issue. As a temporary workaround, consider restricting access to the Kubernetes API to minimize the risk of exploitation. Avoid accessing third-party sites while logged into a Rancher server until the issue is resolved.

Fix

XSS

CSRF

Weakness Enumeration

CWE-79

CWE-352

Related Identifiers

CVE-2019-13209

GHSA-XHG2-RVM8-W2JH

GO-2022-0755

Affected Products

Rancher

References · 9

• https://forums.rancher.com/t/rancher-release-v2-2-5-addresses-rancher-cve-2019-13209/14801 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-xhg2-rvm8-w2jh · Vendor Advisory
• https://forums.rancher.com/c/announcements · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-13209 · Security Note
• https://osv.dev/vulnerability/CVE-2019-13209 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2022-0755 · Vendor Advisory
• https://github.com/rancher/rancher · Note
• https://github.com/rancher/rancher/commit/0ddffe484adccb9e37d9432e8e625d8ebbfb0088 · Note
• https://github.com/advisories/GHSA-xhg2-rvm8-w2jh · Note