Listen to this Post
How the CVE Works:
The vulnerability (CVE-2024-XXXX) in Rancher allows a Restricted Administrator to escalate privileges by modifying the passwords of higher-privileged Administrator accounts. Normally, Restricted Admins should only manage users with equal or lower permissions. However, due to improper access control checks, they can bypass this restriction. The flaw occurs when the `manage-users` permission is not enforced during password change requests, enabling unauthorized account takeover. This violates the principle of least privilege, as Restricted Admins gain full administrative control without proper authorization.
DailyCVE Form:
Platform: Rancher
Version: < v2.8.14, < v2.9.8, < v2.10.4
Vulnerability: Privilege Escalation
Severity: Critical
Date: 2024-XX-XX
What Undercode Say:
Exploitation:
1. Attacker logs in as a Restricted Admin.
- Sends a crafted API request to modify an Admin’s password:
curl -X PUT -H "Authorization: Bearer <JWT>" -d '{"newPassword":"Hacked123!"}' https://rancher-server/v3/users/<admin-id>
3. Gains full Admin access.
Mitigation:
- Upgrade to patched versions (v2.8.14, v2.9.8, v2.10.4, or v2.11.0).
2. Apply RBAC controls to restrict password changes:
- apiGroups: [bash] resources: [bash] verbs: [bash] resourceNames: [bash]
3. Audit roles with:
kubectl get clusterrolebindings -o wide | grep "restricted-admin"
Detection:
- Monitor suspicious password reset logs:
kubectl logs -n cattle-system rancher- | grep "passwordChange"
- Check for anomalous API calls:
auditctl -w /var/lib/rancher -p wa -k rancher_changes
References:
- bash
- Rancher Security Advisory: [bash]
References:
Reported By: https://github.com/advisories/GHSA-8p83-cpfg-fj3g
Extra Source Hub:
Undercode
