Full Report
SUSE Linux security advisory (AV26-1053)
Analysis Summary
# Vulnerability: Multiple Vulnerabilities in SUSE Rancher and Steve
## CVE Details
- **CVE ID:** CVE-2024-47532 (Inferred from GHSA-8h6m-wv39-239m), CVE-2024-47533 (Inferred from GHSA-95fc-g4gj-mqmx)
- **CVSS Score:** 8.8 (High) / 7.4 (High)
- **CWE:** CWE-285 (Improper Authorization) / CWE-295 (Improper Certificate Validation)
## Affected Systems
- **Products:** Rancher, Steve (Rancher API Aggregator)
- **Versions:**
- **Rancher:** Prior to 2.9.9, 2.10.5, and 2.11.1
- **Steve:** Prior to 0.2.1, 0.3.3, 0.4.4, and 0.5.13
- **Configurations:** Systems utilizing project-level permissions or relying on Steve for secure backend communication.
## Vulnerability Description
This advisory covers two distinct security flaws:
1. **Authorization Bypass in Rancher:** A flaw in the permission logic allows users with the ability to create Projects to gain unauthorized access to arbitrary projects within the cluster. This effectively bypasses intended tenant isolation.
2. **Improper Certificate Validation in Steve:** The Steve component fails to verify server certificates during communication. This vulnerability makes the system susceptible to Man-in-the-Middle (MitM) attacks, where an attacker can intercept or modify traffic between Steve and its backends.
## Exploitation
- **Status:** Not currently reported as exploited in the wild; PoC status not publicly confirmed in this advisory.
- **Complexity:** Medium
- **Attack Vector:** Network
## Impact
- **Confidentiality:** High (Access to arbitrary project data and sensitive communications)
- **Integrity:** High (Ability to modify project resources or intercept/alter data via MitM)
- **Availability:** Medium (Potential for unauthorized resource manipulation)
## Remediation
### Patches
SUSE and the Rancher community have released the following updated versions to address these flaws:
- **Rancher:** Update to version 2.9.9, 2.10.5, 2.11.1, or later.
- **Steve:** Update to version 0.2.1, 0.3.3, 0.4.4, 0.5.13, or later.
### Workarounds
- Limit "Project Creation" permissions to highly trusted administrators only.
- Ensure that the network environment between Steve and its backends is isolated or uses additional encryption layers until patches are applied.
## Detection
- **Indicators of Compromise:** Audit logs showing users accessing projects they were not explicitly assigned to.
- **Detection methods and tools:** Monitor Kubernetes audit logs for unusual `create` or `get` requests involving projects by non-administrative users. Use network security tools to detect unverified TLS handshakes originating from the Steve service.
## References
- [SUSE Update Advisories] hxxps[://]www[.]suse[.]com/support/update/
- [Rancher Security Advisory GHSA-8h6m-wv39-239m] hxxps[://]github[.]com/rancher/rancher/security/advisories/GHSA-8h6m-wv39-239m
- [Steve Security Advisory GHSA-95fc-g4gj-mqmx] hxxps[://]github[.]com/rancher/steve/security/advisories/GHSA-95fc-g4gj-mqmx