PT-2022-4760 · Suse · Suse Rancher

Florian Struck + 1 · Published 2022-09-07 · Updated 2023-01-18 · CVE-2021-36782

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SUSE Rancher versions prior to 2.5.16 SUSE Rancher versions prior to 2.6.7

Description The issue is related to the cleartext storage of sensitive information in SUSE Rancher, allowing authenticated users to retrieve plaintext versions of sensitive data using the Kubernetes API. This affects various roles, including Cluster Owners, Cluster Members, Project Owners, Project Members, and User Base. The exposed credentials are visible on several endpoints, including "/v1/management.cattle.io.catalogs", "/v1/management.cattle.io.cluster", and others. The exposure of Rancher's serviceAccountToken allows any standard user to escalate its privileges to cluster administrator in Rancher. Sensitive fields have been addressed by this security fix, including Notifier.SMTPConfig.Password, Notifier.WechatConfig.Secret, and others.

Recommendations For SUSE Rancher versions prior to 2.5.16, upgrade to version 2.5.16 or later. For SUSE Rancher versions prior to 2.6.7, upgrade to version 2.6.7 or later. As a temporary workaround, limit access in Rancher to trusted users. It is highly advised to rotate Rancher's serviceAccountToken after upgrading to a patched version. The local and downstream clusters should be checked for potential unrecognized services, users, and API keys. Review for potential leaked credentials and change them if deemed necessary.

Exploit

Fix

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-312

Related Identifiers

BDU:2022-05660

CVE-2021-36782

GHSA-G7J7-H4Q8-8W2F

Affected Products

Suse Rancher

References · 9

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/rancher_authenticated_api_cred_exposure.rb · Exploit
• 🔥 https://github.com/rancher/rancher/security/advisories/GHSA-g7j7-h4q8-8w2f · Exploit
• 🔥 https://bugzilla.suse.com/show_bug.cgi?id=1193988 · Exploit
• https://osv.dev/vulnerability/CVE-2021-36782 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-05660 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-36782 · Security Note
• https://osv.dev/vulnerability/GHSA-g7j7-h4q8-8w2f · Vendor Advisory
• https://github.com/rancher/rancher · Note
• https://t.me/cvenotify/42283 · Telegram Post