PT-2023-1495 · Suse · Suse Rancher

Guilherme Macedo · Published 2023-01-25 · Updated 2023-02-15 · CVE-2022-43757

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SUSE Rancher versions prior to 2.5.17 SUSE Rancher versions prior to 2.6.10 SUSE Rancher versions prior to 2.7.1

Description A Cleartext Storage of Sensitive Information issue in SUSE Rancher allows users on managed clusters to gain access to credentials. The impact depends on the credentials exposed. This issue affects the storage of sensitive fields, secret tokens, encryption keys, and SSH keys that were still being stored in plaintext directly on Kubernetes objects like Clusters. The exposed credentials are visible in Rancher to authenticated Cluster Owners, Cluster Members, Project Owners, and Project Members of that cluster on the endpoints: "/v1/management.cattle.io.cluster" and "/v1/management.cattle.io.clustertemplaterevisions". The fields that have been addressed by this security fix include Cluster.Spec.RancherKubernetesEngineConfig.Services.KubeAPI.SecretsEncryptionConfig.CustomConfig.Providers[].AESGCM.Keys[].Secret, Cluster.Spec.RancherKubernetesEngineConfig.Services.KubeAPI.SecretsEncryptionConfig.CustomConfig.Providers[].AESCBC.Keys[].Secret, and others.

Recommendations For SUSE Rancher versions prior to 2.5.17, update to version 2.5.17 or later. For SUSE Rancher versions prior to 2.6.10, update to version 2.6.10 or later. For SUSE Rancher versions prior to 2.7.1, update to version 2.7.1 or later. After upgrading to a patched version, check for the ACISecretsMigrated and RKESecretsMigrated conditions on Clusters and ClusterTemplateRevisions to confirm when secrets have been fully migrated off of those objects. As a temporary workaround, consider restricting access to the vulnerable endpoints until a patch is available. Review for potentially leaked credentials and change them if deemed necessary.

Exploit

Fix

Cleartext Storage of Sensitive Information

Information Disclosure

OS Command Injection

Weakness Enumeration

CWE-312

CWE-200

CWE-256

CWE-78

Related Identifiers

BDU:2023-00908

BDU:2023-00909

CVE-2022-43757

GHSA-CQ4P-VP5Q-4522

Affected Products

Suse Rancher

References · 11

• 🔥 https://bugzilla.suse.com/show_bug.cgi?id=1205295 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-43757 · Security Note
• https://bdu.fstec.ru/vul/2023-00908 · Security Note
• https://osv.dev/vulnerability/CVE-2022-43757 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-00909 · Security Note
• https://osv.dev/vulnerability/GHSA-cq4p-vp5q-4522 · Vendor Advisory
• https://github.com/rancher/rancher · Note
• https://github.com/rancher/rancher/security/advisories/GHSA-cq4p-vp5q-4522 · Note
• https://t.me/cibsecurity/57656 · Telegram Post
• https://t.me/cvenotify/43766 · Telegram Post
• https://t.me/cvenotify/43778 · Telegram Post