CVE-2017-7297 Rancher Access Control Vulnerability

What is CVE-2017-7297?

CVE-2017-7297 is a high-severity missing authorization vulnerability in n/a, published on 29 Mar 2017. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Rancher Labs rancher server 1.2.0+ is vulnerable to authenticated users disabling access control via an API call. This is fixed in versions rancher/server:v1.2.4, rancher/server:v1.3.5, rancher/server:v1.4.3, and rancher/server:v1.5.3.

Which versions are affected by CVE-2017-7297?

9 open source packages ship an affected version, including github.com/rancher/rancher. It affects 1 product.

Products include Suse Rancher.

How do I fix CVE-2017-7297?

Upgrade github.com/rancher/rancher to a fixed version for your release line: 1.2.4, 1.3.5, 1.4.3 or 1.5.3.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2017-7297 being exploited?

There is no known exploitation of CVE-2017-7297 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2023-22647 Rancher vulnerable to Privilege Escalation via manipulation of Secrets Critical 9.9
• CVE-2023-22651 Rancher Webhook is misconfigured during upgrade process Critical 9.9
• CVE-2022-43757 Rancher: Exposure of sensitive fields Critical 9.9
• CVE-2021-36782 Rancher: Plaintext storage and exposure of credentials in Rancher API and cluster.management.cattle.io object Critical 9.9
• CVE-2021-36783 Rancher: Failure to properly sanitize credentials in cluster template answers Critical 9.9

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-w3x4-9854-95x8, GO-2023-1973.