Rancher Fleet Cross Namespace Secret Disclosure via Unvalidated valuesFrom (CVE-2024-4835)

Vulnerability Overview Vulnerability Name: Cross namespace secret disclosure via unvalidated references in Helm Deployer Vulnerability ID: GHSA-xr65-5cpm-q36x Severity: Critical (9.9 / 10) Release Date: May 28, 2023 Affected Range Affected Versions: - >=0.15.0, =0.14.0, =0.13.0, =0.12.0, <0.12.15 Impact Description: - The vulnerability exists in multi-tenant environments of Rancher Manager when different tenants share the same downstream cluster. - Unpatched tenants can bypass restrictions to access any ConfigMap or Secret in all namespaces on the downstream cluster. - Attackers can exploit this vulnerability by: 1. Using in (via the resource) or resource to read the contents of any Secret on the downstream cluster, provided the name, namespace, and key are known or guessed. 2. Deploying and resources without restricting them to the Fleet Agent's specific ServiceAccount. Remediation Patch Versions: - v0.15.2 - v0.14.6 - v0.13.11 - v0.12.15 Remediation Recommendations: - Upgrade to the patched version of Fleet. - Use the new Policy resource to restrict Fleet Agent operations on downstream clusters: - Configure , , and to require a specific ServiceAccount. - Restrict the use of Helm repository and chart URLs using regular expression matching. - Ensure the required ServiceAccounts are available on the downstream cluster and configured with least privilege. Additional Information CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Changed - Confidentiality: High - Integrity: High - Availability: High CVE ID: CVE-2024-4835 References: - MITRE ATT&CK - Technique - Unsecured Credentials - SUSE Rancher Security Team - Rancher Repository - Support Matrix and Product Life Cycle POC Code No POC code available.

Goal Reached Thanks to every supporter — we hit 100%!

Rancher Fleet Cross Namespace Secret Disclosure via Unvalidated valuesFrom (CVE-2024-4835)

More from this source