PT-2022-10549 · Suse · Suse Rancher
Jonathan Mercier
·
Published
2022-05-02
·
Updated
2022-11-21
·
CVE-2021-36778
CVSS v3.1
8.3
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L |
Name of the Vulnerable Software and Affected Versions
SUSE Rancher versions prior to 2.5.12
SUSE Rancher versions prior to 2.6.3
Description
The issue allows administrators of third-party repositories to gather credentials sent to their servers due to an incorrect authorization vulnerability. This occurs when a user configures access credentials to a private repository in Rancher inside
Apps & Marketplace > Repositories. An insufficient check of the same-origin policy when downloading Helm charts from a configured private repository can lead to exposure of the repository credentials to a third-party provider. This happens when the private repository does an HTTP redirect to a third-party repository or external storage provider, or downloads an icon resource for the chart hosted on a third-party provider. The address of the private repository is not leaked, only the credentials are leaked in the HTTP Authorization header in base64 format.Recommendations
For SUSE Rancher versions prior to 2.5.12, update to version 2.5.12 or later.
For SUSE Rancher versions prior to 2.6.3, update to version 2.6.3 or later.
As a temporary workaround, check the Helm charts in your configured private repository for possible redirects to third-party storage, and for Helm chart icons from third-party sources.
Evaluate any Helm chart that might lead to the mentioned scenario and change affected credentials if deemed necessary.
Fix
Information Disclosure
Insufficiently Protected Credentials
Incorrect Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Suse Rancher