GHSA-xhg2-rvm8-w2jhHighCVSS 8.7

Rancher Vulnerable to Cross-site Request Forgery (CSRF)

Published
May 18, 2021
Last Modified
September 18, 2023

🔗 CVE IDs covered (1)

CVE-2019-13209 →

📋 Description

Rancher 2 through 2.2.4 is vulnerable to a Cross-Site Websocket Hijacking attack that allows an exploiter to gain access to clusters managed by Rancher. The attack requires a victim to be logged into a Rancher server, and then to access a third-party site hosted by the exploiter. Once that is accomplished, the exploiter is able to execute commands against the cluster's Kubernetes API with the permissions and identity of the victim.

🎯 Affected products3

  • go/github.com/rancher/rancher:>= 2.0.0, < 2.0.16
  • go/github.com/rancher/rancher:>= 2.1.0, < 2.1.11
  • go/github.com/rancher/rancher:>= 2.2.0, < 2.2.5

🔗 References (4)