PT-2022-11526 · Suse · Suse Rancher

Guilherme Macedo · Published 2022-05-02 · Updated 2023-01-18 · CVE-2021-4200

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions SUSE Rancher versions prior to 2.5.13 SUSE Rancher versions prior to 2.6.4

Description A vulnerability in SUSE Rancher allows write access to the Catalog for any user when the restricted-admin role is enabled. This issue affects customers using the restricted-admin role in Rancher, which must be bootstrapped with the environment variable CATTLE RESTRICTED DEFAULT ADMIN=true or the configuration flag restrictedAdmin=true. The vulnerability grants write access to templates (CatalogTemplates) and template versions (CatalogTemplateVersions) for any user with any level of catalog access. A malicious user could abuse this vulnerability to modify application visibility, change logos, make charts appear as trusted or partner charts, or swap template versions. This vulnerability does not allow modification of the base64 encoded files fields of the templateVersions.

Recommendations For SUSE Rancher versions prior to 2.5.13, update to version 2.5.13 or later. For SUSE Rancher versions prior to 2.6.4, update to version 2.6.4 or later. As a temporary workaround, limit access in Rancher to trusted users. If using the restricted-admin as the default admin role, review CatalogTemplates and CatalogTemplateVersions for possible malicious modifications.

Fix

Improper Authorization

Improper Privilege Management

Weakness Enumeration

CWE-285

CWE-269

Related Identifiers

CVE-2021-4200

GHSA-HX8W-GHH8-R4XF

Affected Products

Suse Rancher

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2021-4200 · Security Note
• https://osv.dev/vulnerability/GHSA-hx8w-ghh8-r4xf · Vendor Advisory
• https://bugzilla.suse.com/show_bug.cgi?id=1193992 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-4200 · Vendor Advisory
• https://github.com/rancher/rancher/security/advisories/GHSA-hx8w-ghh8-r4xf · Note
• https://t.me/cvenotify/29918 · Telegram Post
• https://t.me/cibsecurity/41716 · Telegram Post
• https://rancher.com/docs/rancher/v2.6/en/admin-settings/rbac/global-permissions/#restricted-admin · Note
• https://t.me/cvenotify/42284 · Telegram Post