GHSA-v3vj-5868-2ch2 CVE-2024-58267 GO-2025-3984
Rancher CLI SAML authentication is vulnerable to phishing attacks
- Severity
- 8.0 / 10
- High · CVSS 3.1
- Exploit chance (EPSS)
- 0.24%
- Chance of exploitation in the next 30 days. Higher than 14.98% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-345 Insufficient Verification of Data Authenticity
- Fix
2.12.2- Upgrade github.com/rancher/rancher to this version or later
Description
Impact
A vulnerability has been identified within Rancher Manager whereby the SAML authentication from the Rancher CLI tool is vulnerable to phishing attacks. The custom authentication protocol for SAML-based providers can be abused to steal Rancher’s authentication tokens.
Rancher Manager deployments without SAML authentication enabled are not affected by this vulnerability.
An attacker can generate a phishing SAML login URL which contains a publicKey and requestId controlled by the attacker. The attacker can then give the link to another user (eg: admin) and if the victim goes to the link unsuspectingly, they might not notice the bad parameters in the URL. The user will be prompted to login and might believe that its session has ended so they need to re-login. By clicking on the link, they will be logged in and an encrypted token will be created with the attacker's public key. The attacker can then decrypt the victim’s Rancher token, enabling the attack
Please consult the associated MITRE ATTACK Techniques - Privilege Escalation for further information about this category of attack.
Patches
This vulnerability is addressed by changes in both Rancher Manager and the CLI. The fixed versions:
- The Rancher CLI now reports the
requestIdthat is relevant to the authentication session in process as a separate message to the terminal, making it easier for the user to identify and compare. - The Rancher login page for SAML authentication will display a suitable warning to ensure that the user seeing the login page is aware of the login process with the related
requestId, enabling users to verify whether the request was intended or not.
Patched versions of Rancher include releases v2.12.2, v2.11.6, v2.10.10, and v2.9.12.
Workarounds
If you cannot update to one of the fixed versions, make sure to check the URL printed by the Rancher CLI when performing a SAML authentication flow, especially the requestId parameter. The URL and the requestId printed by the CLI must be the same URL that you access and see when finalizing the SAML authentication flow in your browser for the Rancher UI. The URL has the format:
<rancher_ui_address>/dashboard/auth/login?requestId=<requestid>&publicKey=<pubkey>&responseType=<responsetype>
If the URL presented in the browser is different from the one logged by the CLI, the user must not proceed with the login, as they might be under a phishing attack.
References
If you have any questions or comments about this advisory:
- Reach out to the SUSE Rancher Security team for security related inquiries.
- Open an issue in the Rancher repository.
- Verify with our support matrix and product support lifecycle.
Affected versions
Go
| Package | Vulnerable | Fixed in |
|---|---|---|
| github.com/rancher/rancher | >= 2.12.0, < 2.12.2 |
2.12.2 |
| github.com/rancher/rancher | >= 2.11.0, < 2.11.6 |
2.11.6 |
| github.com/rancher/rancher | >= 2.10.0, < 2.10.10 |
2.10.10 |
| github.com/rancher/rancher | >= 2.9.0, < 2.9.12 |
2.9.12 |
| github.com/rancher/rancher | all versions |
No fix yet |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
github.com/rancher/rancher Go → 2.12.2
- go
go get github.com/rancher/rancher@v2.12.2 && go mod tidy
Severity breakdown
CVSS 3.1 8.0
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
- Attack vector
- Network
- Attack complexity
- High
- Privileges required
- Low
- User interaction
- Required
- Scope
- Changed
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Weakness
CWE-345: Insufficient Verification of Data Authenticity
The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-4j6x-2764-m8gh Rancher has over-inclusive team membership expansion in GitHub App authentication provider | High | Also affects github.com/rancher/rancher |
| GHSA-vx8h-4prv-g744 Rancher has Privilege Escalation from Project Owner to Host | High | Also affects github.com/rancher/rancher |
| GHSA-mhc6-2gfq-xx62 Rancher vulnerable to command injection through unsanitized YAML parameter | Critical | Also affects github.com/rancher/rancher |
| GHSA-5v3h-x4wf-5c35 Rancher Extensions have arbitrary file access via path traversal | High | Also affects github.com/rancher/rancher |
| GHSA-gqf8-rvrh-g7w6 Rancher cloud credentials can be used through proxy API by users without access | Critical | Also affects github.com/rancher/rancher |
| GHSA-hwm2-4ph6-w6m5 Rancher's restricted PodSecurityPolicy does not prevent containers from running as a privileged user | High | Also affects github.com/rancher/rancher |
| GHSA-mc24-7m59-4q5p Rancher CLI skips TLS verification on Rancher CLI login command | Medium | Also affects github.com/rancher/rancher |
| GHSA-mw39-9qc2-f7mg Rancher exposes sensitive information through audit logs | Medium | Also affects github.com/rancher/rancher |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor