CVE-2023-32192 Rancher API Server Cross-site Scripting Vulnerability
An attacker can execute arbitrary JavaScript in victim browsers via unauthenticated XSS in the Rancher API Server public endpoint.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2023-32192?
CVE-2023-32192 is a high-severity cross-site scripting vulnerability in SUSE apiserver, published on 16 Oct 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A vulnerability has been identified in which unauthenticated cross-site scripting (XSS) in the API Server's public API endpoint can be exploited, allowing an attacker to execute arbitrary JavaScript code in the victim browser
Weakness: CWE-80
Which versions are affected by CVE-2023-32192?
3 open source packages ship an affected version, including github.com/rancher/apiserver.
| Package | Affected | Fixed in |
|---|---|---|
github.com/rancher/apiserver Go | All versions | 0.0.0-20240207153957-4fd7d821d952 |
github.com/rancher/apiserver Go | All versions | 0.0.0-20240207153957-4fd7d821d952 |
github.com/rancher/apiserver Go | All versions | 0.0.0-20240207153957-4fd7d821d952 |
How do I fix CVE-2023-32192?
Upgrade github.com/rancher/apiserver to 0.0.0-20240207153957-4fd7d821d952 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2023-32192 being exploited?
There is no known exploitation of CVE-2023-32192 in the wild and no public exploit code.
Sources
Also known as GHSA-833m-37f7-jq55, GO-2024-2534.