CVE-2018-20321: Access Control Bypass in Rancher
Summary
CVE-2018-20321: Access Control Bypass. Affects github.com/rancher/rancher versions >= 2.0.0, < 2.1.6. Fixed in 2.1.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Rancher is an open-source container management platform that allows users to deploy and manage containers in a Kubernetes cluster. It provides a user-friendly interface for managing containerized applications and simplifies the deployment process. However, Rancher versions 2 through 2.1.5 are vulnerable to an access control bypass issue.
Vulnerability Detail
The vulnerability, identified as CVE-2018-20321, allows any project member with access to the default namespace in Rancher to mount the netes-default service account in a pod. This enables them to execute administrative privileged commands against the Kubernetes cluster. The issue affects all clusters created or imported by Rancher before version 2.1.6. Exploiting this vulnerability could lead to unauthorized access and potential compromise of the cluster.
How To Fix
Minimum fixed version
2.1.6
This is the first release that contains the fix.
go get github.com/rancher/rancher@v2.1.6Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, cluster admins can manually review and restrict access to the default namespace, ensuring that only trusted users have permissions to access it. This can be done by modifying the RBAC (Role-Based Access Control) settings in the Kubernetes cluster.
Conclusion
The access control bypass vulnerability in Rancher versions 2 through 2.1.5 allows unauthorized users to execute administrative privileged commands against the Kubernetes cluster. To mitigate this issue, it is recommended to isolate the default namespace in a separate project and upgrade Rancher to version 2.1.6 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/rancher/rancher →
FAQ
Rancher is an open-source container management platform that simplifies the deployment and management of containerized applications in a Kubernetes cluster.
This vulnerability allows unauthorized users with access to the default namespace to execute administrative privileged commands against the Kubernetes cluster, potentially leading to unauthorized access and compromise of the cluster.
Rancher versions 2 through 2.1.5 are affected by this vulnerability. All clusters created or imported by Rancher before version 2.1.6 are vulnerable.
To fix this vulnerability, it is recommended to isolate the default namespace in a separate project where only cluster admins have permissions to access. Upgrading Rancher to version 2.1.6 or later will also address the issue.
As a workaround, cluster admins can manually review and restrict access to the default namespace by modifying the RBAC settings in the Kubernetes cluster.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/rancher/rancher.
