GHSA-8c69-r38j-rpfj CVE-2022-43755
Rancher cattle-token is predictable
- Severity
- 7.1 / 10
- Critical · CVSS 3.1
- Exploit chance (EPSS)
- 1.72%
- Chance of exploitation in the next 30 days. Higher than 77.48% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Fix
2.6.10- Upgrade github.com/rancher/rancher to this version or later
Description
Impact
An issue was discovered in Rancher versions up to and including 2.6.9 and 2.7.0, where the cattle-token secret, used by the cattle-cluster-agent, is predictable. Even after the token is regenerated, it will have the same value. This issue is not present in Rancher 2.5 releases.
The cattle-token is used by Rancher's cattle-cluster-agent to connect to the Kubernetes API of Rancher provisioned downstream clusters. The problem occurs because the cattle-token secret does not use any random value in its composition, which causes it to always be regenerated with the same value. This can pose a serious problem if the token is compromised and needs to be recreated for security purposes.
The usage of the cattle-token by an unauthorized user allows to escalate privileges to the cluster owner of the affected downstream cluster. It does not allow access to Rancher's own local cluster (the cluster where Rancher is provisioned).
Workarounds
In case it is not possible to promptly update to a patched version, a workaround is to use the rotate script provided in the public security advisory CVE-2021-36782 / GHSA-g7j7-h4q8-8w2f, which facilitates the rotation and creation of a new unique downstream cluster token.
Patches
Patched versions include releases 2.6.10, 2.7.1 and later versions.
After upgrading to one of the patched versions, it is highly recommended to rotate the cattle-token in downstream clusters to guarantee that a new random token will be safely regenerated.
The procedure below can rotate the cattle-token and should be executed in each downstream cluster provisioned by Rancher. It is recommended to first test this process in an appropriate development/testing environment.
# Verify the current secret before rotating it
$ kubectl describe secrets cattle-token -n cattle-system
# Delete the secret
$ kubectl delete secrets cattle-token -n cattle-system
# Restart the cattle-cluster-agent deployment
$ kubectl rollout restart deployment/cattle-cluster-agent -n cattle-system
# Confirm that a new and different secret was generated
$ kubectl describe secrets cattle-token -n cattle-system
For more information
If you have any questions or comments about this advisory:
- Reach out to SUSE Rancher Security team for security related inquiries.
- Open an issue in Rancher repository.
- Verify our support matrix and product support lifecycle.
Affected versions
Go
| Package | Vulnerable | Fixed in |
|---|---|---|
| github.com/rancher/rancher | >= 2.6.0, < 2.6.10 |
2.6.10 |
| github.com/rancher/rancher | >= 2.7.0, < 2.7.1 |
2.7.1 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
github.com/rancher/rancher Go → 2.6.10
- go
go get github.com/rancher/rancher@v2.6.10 && go mod tidy
Severity breakdown
CVSS 3.1 7.1
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H
- Attack vector
- Network
- Attack complexity
- High
- Privileges required
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- Low
- Availability
- High
Weakness
CWE-330: Use of Insufficiently Random Values
The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.
How to prevent it
- Architecture and Design: Use a well-vetted algorithm that is currently considered to be strong by experts in the field, and select well-tested implementations with adequate length seeds. In general, if a pseudo-random number generator is not advertised as being cryptographically secure, then it is probably a statistical PRNG and should not be used in security-sensitive contexts. Pseudo-random number generators can produce predictable numbers if the generator is known and the seed can be guessed. A 256-bit seed is a good starting point for producing a "random enough" number.
- Implementation: Consider a PRNG that re-seeds itself as needed from high quality pseudo-random output sources, such as hardware devices.
- Architecture and Design, Requirements: Use products or modules that conform to FIPS 140-2 [REF-267] to avoid obvious entropy problems. Consult FIPS 140-2 Annex C ("Approved Random Number Generators").
CWE-331: Insufficient Entropy
The product uses an algorithm or scheme that produces insufficient entropy, leaving patterns or clusters of values that are more likely to occur than others.
How to prevent it
- Implementation: Determine the necessary entropy to adequately provide for randomness and predictability. This can be achieved by increasing the number of bits of objects such as keys and seeds.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-4j6x-2764-m8gh Rancher has over-inclusive team membership expansion in GitHub App authentication provider | High | Also affects github.com/rancher/rancher |
| GHSA-vx8h-4prv-g744 Rancher has Privilege Escalation from Project Owner to Host | High | Also affects github.com/rancher/rancher |
| GHSA-mhc6-2gfq-xx62 Rancher vulnerable to command injection through unsanitized YAML parameter | Critical | Also affects github.com/rancher/rancher |
| GHSA-5v3h-x4wf-5c35 Rancher Extensions have arbitrary file access via path traversal | High | Also affects github.com/rancher/rancher |
| GHSA-gqf8-rvrh-g7w6 Rancher cloud credentials can be used through proxy API by users without access | Critical | Also affects github.com/rancher/rancher |
| GHSA-hwm2-4ph6-w6m5 Rancher's restricted PodSecurityPolicy does not prevent containers from running as a privileged user | High | Also affects github.com/rancher/rancher |
| GHSA-mc24-7m59-4q5p Rancher CLI skips TLS verification on Rancher CLI login command | Medium | Also affects github.com/rancher/rancher |
| GHSA-mw39-9qc2-f7mg Rancher exposes sensitive information through audit logs | Medium | Also affects github.com/rancher/rancher |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor