Reliance on Untrusted Inputs in a Security Decision Affecting github.com/rancher/rancher/pkg/multiclustermanager package, versions >=2.0.0 <2.4.16 >=2.5.0 <2.5.9
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-GOLANG-GITHUBCOMRANCHERRANCHERPKGMULTICLUSTERMANAGER-6673742
- published 25 Apr 2024
- disclosed 24 Apr 2024
- credit Unknown
Introduced: 24 Apr 2024
CVE-2021-31999 Open this link in a new tabHow to fix?
Upgrade github.com/rancher/rancher/pkg/multiclustermanager to version 2.4.16, 2.5.9 or higher.
Overview
Affected versions of this package are vulnerable to Reliance on Untrusted Inputs in a Security Decision via the Connection header. An attacker can gain unauthorized access to information by crafting an API request with the Impersonate-User or Impersonate-Group header included in the Connection header, which is then correctly removed by the proxy. This allows the request to act as if it was from the Rancher management server, thus bypassing intended access controls.
Note:
This is only exploitable if the attacker is a valid Rancher user with some level of permissions on the cluster.