| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/rancher/rancher | ≥ 2.9.0, < 2.9.4all versions | 2.9.4 |
A vulnerability has been identified within Rancher UI that allows a malicious actor to perform a Stored XSS attack through the cluster description field.
Please consult the associated MITRE ATT&CK - Technique - Drive-by Compromise for further information about this category of attack.
The fix introduces new changes in the directives responsible for sanitizing HTML code before rendering.
We replaced the v-tooltip directive with the v-clean-tooltip directive.
Patched versions include releases 2.9.4 and 2.10.0.
There are no workarounds for this issue. Users are recommended to upgrade, as soon as possible, to a version of /Rancher Manager which contains the fixes.
This issue was identified and reported by Bhavin Makwana from Workday’s Cyber Defence Team.
If you have any questions or comments about this advisory:
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free