CVE-2022-43758
published 2023-02-07CVE-2022-43758: A Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in SUSE Rancher allows code execution for user with…
PriorityP336medium6.8CVSS 3.1
AVNACLPRHUIRSUCHIHAH
EPSS
0.98%
57.8th percentile
A Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in SUSE Rancher allows code execution for user with the ability to add an untrusted Helm catalog or modifying the URL configuration used to download KDM (only admin users by default) This issue affects: SUSE Rancher Rancher versions prior to 2.5.17; Rancher versions prior to 2.6.10; Rancher versions prior to 2.7.1.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | rancher_rancher | >= 2.5.0 < 2.5.17 | 2.5.17 |
| github.com | rancher_rancher | >= 2.6.0 < 2.6.10 | 2.6.10 |
| github.com | rancher_rancher | >= 2.7.0 < 2.7.1 | 2.7.1 |
| suse | rancher | >= 2.5.0 < 2.5.17 | 2.5.17 |
| suse | rancher | >= 2.6.0 < 2.6.10 | 2.6.10 |
| suse | rancher | >= 2.7.0 < 2.7.1 | 2.7.1 |
| suse | rancher | >= Rancher < 2.5.17 | 2.5.17 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Command injection in Rancher Git package
ghsa·2023-01-25
CVE-2022-43758 [MEDIUM] CWE-77 Command injection in Rancher Git package
Command injection in Rancher Git package
### Impact
An issue was discovered in Rancher from versions 2.5.0 up to and including 2.5.16, 2.6.0 up to and including 2.6.9 and 2.7.0, where a command injection vulnerability is present in the Rancher Git package. This package uses the underlying Git binary available in the Rancher container image to execute Git operations.
Specially crafted commands, when not properly disambiguated, can cause confusion when executed through Git, resulting in command injection in the underlying Rancher host.
This issue can potentially be exploited in Rancher in two ways:
1. Adding an untrusted Helm catalog, in the Catalogs menu, that contains maliciously designed repo URL configuration in Helm charts.
2. Modifying the URL configuration used to download KDM (K
OSV
Command injection in Rancher Git package
osv·2023-01-25
CVE-2022-43758 [MEDIUM] Command injection in Rancher Git package
Command injection in Rancher Git package
### Impact
An issue was discovered in Rancher from versions 2.5.0 up to and including 2.5.16, 2.6.0 up to and including 2.6.9 and 2.7.0, where a command injection vulnerability is present in the Rancher Git package. This package uses the underlying Git binary available in the Rancher container image to execute Git operations.
Specially crafted commands, when not properly disambiguated, can cause confusion when executed through Git, resulting in command injection in the underlying Rancher host.
This issue can potentially be exploited in Rancher in two ways:
1. Adding an untrusted Helm catalog, in the Catalogs menu, that contains maliciously designed repo URL configuration in Helm charts.
2. Modifying the URL configuration used to download KDM (K
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2023-02-07
Published