| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/rancher/rancher | ≥ 2.5.0, < 2.5.10all versions | 2.5.10 |
| rancher | < 2.5.10 | 2.5.10 |
A flaw discovered in Rancher versions from 2.5.0 up to and including 2.5.9 allows an authenticated user to impersonate any user on a cluster through the Steve API proxy, without requiring knowledge of the impersonated user's credentials. This is due to the Steve API proxy not dropping the impersonation header before sending the request to the Kubernetes API. A malicious user with authenticated access to Rancher could use this to impersonate another user with administrator access in Rancher, receiving, then, administrator level access in the cluster.
Patched versions include releases 2.5.10, 2.6.0 and later versions.
Limit access in Rancher to trusted users. There is not a direct mitigation besides upgrading to the patched Rancher versions.
If you have any questions or comments about this advisory:
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free