CVE-2021-31999: 
Rancher vulnerability analysis and mitigation

A Reliance on Untrusted Inputs in a Security Decision vulnerability (CVE-2021-31999) was discovered in Rancher that allows users in the cluster to act as other users by forging the "Impersonate-User" or "Impersonate-Group" headers. This vulnerability affects Rancher versions prior to 2.5.9 and 2.4.16, and was disclosed on July 15, 2021 (NVD).

The vulnerability stems from improper handling of the "Connection" header in authenticated requests. When a malicious "Connection" header is passed, an attacker can cause the proxy to omit the "Impersonate-User" and "Impersonate-Group" headers on requests made upstream to the Kubernetes API of the attached cluster. The vulnerability has been assigned a CVSS v3.1 score of 8.8 HIGH (NVD, SUSE Bugzilla).

This vulnerability allows authenticated users within the cluster to impersonate other users and groups, effectively enabling privilege escalation and unauthorized access to cluster resources. The high CVSS score reflects the significant potential impact on system security (NVD).

The vulnerability requires an authenticated user within the cluster to exploit. The attack vector involves manipulating the "Connection" header in requests to the Kubernetes API, which can lead to successful impersonation of other users and groups (SUSE Bugzilla).

The vulnerability has been fixed in Rancher versions 2.5.9 and 2.4.16. Users are advised to upgrade to these or later versions to mitigate the security risk (Rancher Release).