Vulnerability DatabaseCVE-2024-22031

CVE-2024-22031:
vulnerability analysis and mitigation

Overview

CVE-2024-22031 is a privilege escalation vulnerability affecting multiple versions of Rancher, a popular open-source container management platform. The vulnerability was discovered in early 2024 and has been assigned a CVSS score of 8.6 (High severity). The flaw affects Rancher versions 2.8.0 and above, specifically impacting versions prior to 2.9.9, 2.10.5, and 2.11.1 (GitHub Advisory, Security Online).

Technical details

The vulnerability stems from a namespace collision issue where a user with project creation privileges on one cluster can create a project with the same name as an existing project in a different cluster. This occurs because Rancher uses the project name as the namespace for storing related resources such as PRTBs and secrets. The vulnerability has been assigned a CVSS v3.1 base score of 8.6, with the vector string CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H, indicating network attack vector, high attack complexity, low privileges required, and high impact on confidentiality, integrity, and availability (GitHub Advisory).

Impact

When exploited, this vulnerability allows an attacker to gain unauthorized access to resources in projects across different clusters, effectively escalating their privileges. The attacker can potentially access, read, or modify any user/business data in the affected projects, and depending on the accessed resources, could impact the entire system's availability (Security Online).

Mitigation and workarounds

The vulnerability has been patched in Rancher versions 2.9.9, 2.10.5, and 2.11.1. The fix introduces a new field called 'backingNamespace' in the project spec instead of using the project name as the namespace. For users unable to upgrade immediately, administrators should prevent users from creating projects with identical names across clusters and can audit existing projects using the command: kubectl get projects -A -o=custom-columns='NAME:metadata.name' | sort | uniq -c. Note that version 2.8 will not receive a patch due to its approaching end-of-life status (GitHub Advisory, Security Online).