x/vulndb: potential Go vuln in github.com/rancher/rancher: GHSA-g25r-gvq3-wrq7

[GoVulnBot]

In GitHub Security Advisory GHSA-g25r-gvq3-wrq7, there is a vulnerability in the following Go packages or modules:

Unit	Fixed	Vulnerable Ranges
github.com/rancher/rancher	2.7.1	>= 2.7.0, < 2.7.1

Cross references:

• Module github.com/rancher/rancher appears in issue x/vulndb: potential Go vuln in github.com/rancher/rancher: GHSA-wm2r-rp98-8pmh #439 EFFECTIVELY_PRIVATE
• Module github.com/rancher/rancher appears in issue x/vulndb: potential Go vuln in github.com/rancher/rancher: CVE-2022-21951 #464 EFFECTIVELY_PRIVATE
• Module github.com/rancher/rancher appears in issue x/vulndb: potential Go vuln in github.com/rancher/rancher: GHSA-4fc7-hc63-7fjg #551 EFFECTIVELY_PRIVATE
• Module github.com/rancher/rancher appears in issue x/vulndb: potential Go vuln in github.com/rancher/rancher: GHSA-hx8w-ghh8-r4xf #605 EFFECTIVELY_PRIVATE
• Module github.com/rancher/rancher appears in issue x/vulndb: potential Go vuln in github.com/rancher/rancher: GHSA-jwvr-vv7p-gpwq, CVE-2021-36784 #610 EFFECTIVELY_PRIVATE
• Module github.com/rancher/rancher appears in issue x/vulndb: potential Go vuln in github.com/rancher/rancher: GHSA-9qq2-xhmc-h9qr #644 EFFECTIVELY_PRIVATE
• Module github.com/rancher/rancher appears in issue x/vulndb: potential Go vuln in github.com/rancher/rancher: CVE-2021-36782 #973 EFFECTIVELY_PRIVATE
• Module github.com/rancher/rancher appears in issue x/vulndb: potential Go vuln in github.com/rancher/rancher: CVE-2021-36783 #974 EFFECTIVELY_PRIVATE
• Module github.com/rancher/rancher appears in issue x/vulndb: potential Go vuln in github.com/rancher/rancher: CVE-2022-31247 #975 EFFECTIVELY_PRIVATE
• Module github.com/rancher/rancher appears in issue x/vulndb: potential Go vuln in github.com/rancher/rancher/server: GHSA-xhg2-rvm8-w2jh #755

See doc/triage.md for instructions on how to triage this report.

modules:
  - module: github.com/rancher/rancher
    versions:
      - introduced: 2.7.0
        fixed: 2.7.1
    packages:
      - package: github.com/rancher/rancher
  - module: github.com/rancher/rancher
    versions:
      - introduced: 2.6.0
        fixed: 2.6.10
    packages:
      - package: github.com/rancher/rancher
  - module: github.com/rancher/rancher
    versions:
      - introduced: 2.5.0
        fixed: 2.5.17
    packages:
      - package: github.com/rancher/rancher
description: "### Impact\n\nAn issue was discovered in Rancher where an authorization
    logic flaw allows an authenticated user on any downstream cluster to (1) open
    a shell pod in the Rancher `local` cluster and (2) have limited `kubectl` access
    to it. The expected behavior is that a user does not have such access in the Rancher
    `local` cluster unless explicitly granted.\n\nThis issue does not allow the user
    to escalate privileges in the `local` cluster directly (this would require another
    vulnerability to be exploited).\n\nThe security issue happens in two different
    ways:\n\n1. Shell pod access - This is when a user opens a shell pod in the Rancher
    UI to a downstream cluster that the user has permission to access. The web request
    can be intercepted using the browser's web inspector/network console or a proxy
    tool to change the shell's destination to the Rancher `local` cluster instead
    of the desired downstream cluster.\n\n   - This flaw cannot be exploited to access
    a downstream cluster that the user has no permissions to.\n\n   - The shell pod
    runs with a limited non-root user, reducing the severity of this issue. However,
    even as a non-root user, it is still possible download and run binaries inside
    the shell pod.\n\n   - The blast radius of this issue can increase based on the
    configuration of the `local` cluster. For example:\n\n      - If the `local` cluster
    has unlimited network access, e.g. to the Internet, the user can open a reverse
    network connection to the shell pod.\n\n      - Or access the cloud metadata API
    of the underlying cloud infrastructure, where the user can extract the credentials
    associated with the `local` cluster and use them to interact with the cloud environment
    (this will be limited by the permissions granted to the cloud credentials in question).
    \n\n      - Check further recommendations about liming access to the cloud metadata
    API in Rancher's [security best practices](https://ranchermanager.docs.rancher.com/reference-guides/rancher-security/kubernetes-security-best-practices).\n\n2.
    Kubectl access - When downloading the kubeconfig file of a downstream cluster
    that the user has access to, the `server` cluster address in the kubeconfig file
    can be changed to point to the Rancher `local` cluster instead of the intended
    downstream cluster.\n\n     - This can also be achieved by crafting a kubeconfig
    using a Rancher token instead of using the kubeconfig from an active cluster.
    \n\n    - This flaw cannot be exploited to access a downstream cluster that the
    user has no permissions to.\n\nNotes:\n- Rancher `local` cluster means the cluster
    where Rancher is installed. It is named as `local` inside the list of clusters
    in the Rancher UI.\n- Audit logs in Rancher can be used to identify possible abuses
    of this issue, by tracking API requests to the user ID of the user that performed
    the action. API audit logs can be enabled as described in the [documentation](https://ranchermanager.docs.rancher.com/how-to-guides/advanced-user-guides/enable-api-audit-log)
    when set to level `1` or above.\n\n### Workarounds\n\nThere is no workaround or
    direct mitigation besides updating to a patched Rancher version.\n\n### Patches\n\nPatched
    versions include releases 2.5.17, 2.6.10, 2.7.1 and later versions.\n\n### For
    more information\n\nIf you have any questions or comments about this advisory:\n\n*
    Reach out to [SUSE Rancher Security team](https://github.com/rancher/rancher/security/policy)
    for security related inquiries.\n* Open an issue in [Rancher](https://github.com/rancher/rancher/issues/new/choose)
    repository.\n* Verify our [support matrix](https://www.suse.com/suse-rancher/support-matrix/all-supported-versions/)
    and [product support lifecycle](https://www.suse.com/lifecycle/)."
cves:
  - CVE-2022-21953
ghsas:
  - GHSA-g25r-gvq3-wrq7

[gopherbot]

Change https://go.dev/cl/466475 mentions this issue: data/excluded: batch add GO-2023-1527, GO-2023-1524, GO-2023-1516, GO-2023-1514, GO-2023-1513, GO-2023-1511, GO-2023-1520, GO-2023-1512, GO-2023-1517, GO-2023-1518

[gopherbot]

Change https://go.dev/cl/592759 mentions this issue: data/reports: unexclude 75 reports