CVE-2021-36776 Steve API proxy impersonation
Remote attackers can impersonate arbitrary users in SUSE Rancher due to improper access control in the API proxy.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-36776?
CVE-2021-36776 is a high-severity authentication bypass vulnerability in SUSE Rancher, published on 1 Apr 2022. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A Improper Access Control vulnerability in SUSE Rancher allows remote attackers impersonate arbitrary users. This issue affects: SUSE Rancher Rancher versions prior to 2.5.10.
Weakness: CWE-284
Which versions are affected by CVE-2021-36776?
3 open source packages ship an affected version, including github.com/rancher/rancher. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/rancher/rancher Go | All versions | None |
github.com/rancher/rancher Go | From 2.5.0 | 2.5.10 |
github.com/rancher/rancher Go | From 2.5.0 | 2.5.10 |
Products include Rancher Rancher.
How do I fix CVE-2021-36776?
Upgrade github.com/rancher/rancher to 2.5.10 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2021-36776 being exploited?
There is no known exploitation of CVE-2021-36776 in the wild and no public exploit code.
Other vulnerabilities in SUSE Rancher
- CVE-2021-25320 Rancher: Cloud credentials can be used through proxy API by users without access
- CVE-2021-36775 Deleting PRTBs associated to a group doesn't cause deletion of corresponding RoleBindings
- CVE-2021-25318 rancher: API group not properly specified when creating Kubernetes RBAC resources
- CVE-2021-31999 Rancher: Privilege escalation vulnerability via malicious Connection header
Sources
Also known as GHSA-gvh9-xgrq-r8hw, GO-2024-2771.