CVE-2022-43759

A Improper Privilege Management vulnerability in SUSE Rancher, allows users with access to the escalate verb on PRTBs to escalate permissions for any -promoted resource in any cluster. This issue affects: SUSE Rancher Rancher versions prior to 2.5.17; Rancher versions prior to 2.6.10.

A Improper Privilege Management vulnerability in SUSE Rancher, allows users with access to the escalate verb on PRTBs to escalate permissions for any -promoted resource in any cluster. This issue affects: SUSE Rancher Rancher versions prior to 2.5.17; Rancher versions prior to 2.6.10.

Impact

An issue was discovered in Rancher versions from 2.5.0 up to and including 2.5.16 and from 2.6.0 up to and including 2.6.9, where an authorization logic flaw allows privilege escalation via project role template binding (PRTB) and -promoted roles. This issue is not present in Rancher 2.7 releases.

Note: Consult Rancher documentation for more information about cluster and project roles and KB 000020097 for information about -promoted roles.

This privilege escalation is possible for users with access to the escalate verb on PRTBs (projectroletemplatebindings.management.cattle.io), including users with * verbs on PRTBs (see notes below for more information). These users can escalate permissions for any -promoted resource (see the table below for a full enumeration) in any cluster where they have a PRTB granting such permissions in at least one project in the cluster.

On a default Rancher setup, only the following roles have such permissions:

1. Project Owner
2. Manage Project Members

These roles have permissions to affect the following resources:

| Resource | API Group | Affected Rancher version | | - | - | - | | navlinks | ui.cattle.io | 2.6 | | nodes | "" | 2.6 | | persistentvolumes | "" | 2.5, 2.6 | | persistentvolumes | core | 2.5, 2.6 | | storageclasses | storage.k8s.io | 2.5, 2.6 | | apiservices | apiregistration.k8s.io | 2.5, 2.6 | | clusterrepos | catalog.cattle.io | 2.5, 2.6 | | clusters (local only) | management.cattle.io | 2.5, 2.6 |

Notes:

1. During the calculation of the CVSS score, privileges required was considered as high because, by default, standard user and user-base users in Rancher do not have create, patch and update permissions on roletemplates.
2. If a role template with access to those objects was already created by another user in the cluster, then this issue can be exploited by users without the mentioned permissions from point 1.

Workarounds

If updating Rancher to a patched version is not possible, then the following workarounds must be observed to mitigate this issue:

1. Only grant Project Owner and Manage Project Members roles to trusted users.
2. Minimize the creation of custom roles that contain the escalate, * or write verbs (create, delete, patch, update) on projectroletemplatebindings resource, and only grant such custom roles to trusted users.
3. Minimize the number of users that have permissions to create, patch and update roletemplates.

Patches

Patched versions include releases 2.5.17 and 2.6.10 and later versions. This issue is not present in Rancher 2.7 releases.

Detection

The following script was developed to list role template bindings that give written access to the affected resources listed above. It is highly recommended to run the script in your environment and review the list of identified roles and role template bindings for possible signs of exploitation of this issue. The script requires jq installed and a kubeconfig with access to Rancher local cluster; it can also be executed in Rancher's kubectl shell.

#!/bin/bash

help="
Usage: bash find_promoted_resource.sh \n \n

Requires: \n
- jq installed and on path \n
- A kubeconfig pointing at rancher's local cluster (can also run from rancher's kubectl shell) \n \n

Outputs a list of roletemplates and roletemplate bindings which give write access to promoted resources.
"

if [[ $1 == "-h" || $1 == "--help" ]]
then
	echo -e $help
	exit 0
fi

# first, get the current roletemplates so that we only issue a get once
kubectl get roletemplates.management.cattle.io -o json >> script_templates.json

# find roles which have write access to a promoted resource. Filter on roleTemplates which fulfill all…

A Improper Privilege Management vulnerability in SUSE Rancher, allows users with access to the escalate verb on PRTBs to escalate permissions for any -promoted resource in any cluster. This issue affects: SUSE Rancher Rancher versions prior to 2.5.17; Rancher versions prior to 2.6.10.

A Improper Privilege Management vulnerability in SUSE Rancher, allows users with access to the escalate verb on PRTBs to escalate permissions for any -promoted resource in any cluster. This issue affects: SUSE Rancher Rancher versions prior to 2.5.17; Rancher versions prior to 2.6.10.

Impact

An issue was discovered in Rancher versions from 2.5.0 up to and including 2.5.16 and from 2.6.0 up to and including 2.6.9, where an authorization logic flaw allows privilege escalation via project role template binding (PRTB) and -promoted roles. This issue is not present in Rancher 2.7 releases.

Note: Consult Rancher documentation for more information about cluster and project roles and KB 000020097 for information about -promoted roles.

This privilege escalation is possible for users with access to the escalate verb on PRTBs (projectroletemplatebindings.management.cattle.io), including users with * verbs on PRTBs (see notes below for more information). These users can escalate permissions for any -promoted resource (see the table below for a full enumeration) in any cluster where they have a PRTB granting such permissions in at least one project in the cluster.

On a default Rancher setup, only the following roles have such permissions:

1. Project Owner
2. Manage Project Members

These roles have permissions to affect the following resources:

| Resource | API Group | Affected Rancher version | | - | - | - | | navlinks | ui.cattle.io | 2.6 | | nodes | "" | 2.6 | | persistentvolumes | "" | 2.5, 2.6 | | persistentvolumes | core | 2.5, 2.6 | | storageclasses | storage.k8s.io | 2.5, 2.6 | | apiservices | apiregistration.k8s.io | 2.5, 2.6 | | clusterrepos | catalog.cattle.io | 2.5, 2.6 | | clusters (local only) | management.cattle.io | 2.5, 2.6 |

Notes:

1. During the calculation of the CVSS score, privileges required was considered as high because, by default, standard user and user-base users in Rancher do not have create, patch and update permissions on roletemplates.
2. If a role template with access to those objects was already created by another user in the cluster, then this issue can be exploited by users without the mentioned permissions from point 1.

Workarounds

If updating Rancher to a patched version is not possible, then the following workarounds must be observed to mitigate this issue:

1. Only grant Project Owner and Manage Project Members roles to trusted users.
2. Minimize the creation of custom roles that contain the escalate, * or write verbs (create, delete, patch, update) on projectroletemplatebindings resource, and only grant such custom roles to trusted users.
3. Minimize the number of users that have permissions to create, patch and update roletemplates.

Patches

Patched versions include releases 2.5.17 and 2.6.10 and later versions. This issue is not present in Rancher 2.7 releases.

Detection

The following script was developed to list role template bindings that give written access to the affected resources listed above. It is highly recommended to run the script in your environment and review the list of identified roles and role template bindings for possible signs of exploitation of this issue. The script requires jq installed and a kubeconfig with access to Rancher local cluster; it can also be executed in Rancher's kubectl shell.

#!/bin/bash

help="
Usage: bash find_promoted_resource.sh \n \n

Requires: \n
- jq installed and on path \n
- A kubeconfig pointing at rancher's local cluster (can also run from rancher's kubectl shell) \n \n

Outputs a list of roletemplates and roletemplate bindings which give write access to promoted resources.
"

if [[ $1 == "-h" || $1 == "--help" ]]
then
	echo -e $help
	exit 0
fi

# first, get the current roletemplates so that we only issue a get once
kubectl get roletemplates.management.cattle.io -o json >> script_templates.json

# find roles which have write access to a promoted resource. Filter on roleTemplates which fulfill all…