PT-2021-3743 · Rancher · Rancher
Jonathan Mercier
·
Published
2021-07-15
·
Updated
2024-06-10
·
CVE-2021-31999
CVSS v2.0
9.0
High
| Vector | AV:N/AC:L/Au:S/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Rancher versions prior to 2.5.9
Rancher versions prior to 2.4.16
Description
A vulnerability in Rancher allows users in the cluster to act as other users by forging the
Impersonate-User or Impersonate-Group headers. This issue is related to errors in processing input data and can be exploited by a remote attacker to escalate privileges. The vulnerability can be exploited by passing the Impersonate-User or Impersonate-Group header in the Connection header of an API request to the proxy for the Kubernetes API of a managed cluster. This allows a malicious Rancher user to gain access to information they do not have access to.Recommendations
For Rancher versions prior to 2.5.9, update to version 2.5.9 or later.
For Rancher versions prior to 2.4.16, update to version 2.4.16 or later.
As a temporary workaround, consider restricting access to the
Impersonate-User and Impersonate-Group headers in the Connection header until a patch is available.
Avoid using the Impersonate-User and Impersonate-Group headers in API requests to the proxy for the Kubernetes API of a managed cluster until the issue is resolved.Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Rancher