CVE-2023-22647
published 2023-06-01CVE-2023-22647: An Improper Privilege Management vulnerability in SUSE Rancher allowed standard users to leverage their existing permissions to manipulate Kubernetes secrets…
PriorityP342high8CVSS 3.1
AVAACLPRLUINSUCHIHAH
EPSS
0.71%
49.1th percentile
An Improper Privilege Management vulnerability in SUSE Rancher allowed standard users to leverage their existing permissions to manipulate Kubernetes secrets in the local
cluster, resulting in the secret being deleted, but their read-level
permissions to the secret being preserved. When this operation was
followed-up by other specially crafted commands, it could result in the
user gaining access to tokens belonging to service accounts in the local cluster.
This issue affects Rancher: from >= 2.6.0 before = 2.7.0 before < 2.7.4.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | rancher_rancher | >= 2.6.0 < 2.6.13 | 2.6.13 |
| github.com | rancher_rancher | >= 2.7.0 < 2.7.4 | 2.7.4 |
| suse | rancher | >= 2.6.0 < 2.6.13 | 2.6.13 |
| suse | rancher | >= 2.7.0 < 2.7.4 | 2.7.4 |
| suse | rancher | >= >= 2.6.0 < < 2.6.13 | < 2.6.13 |
| suse | rancher | >= >= 2.7.0 < < 2.7.4 | < 2.7.4 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Rancher vulnerable to Privilege Escalation via manipulation of Secrets
osv·2023-06-06
CVE-2023-22647 [CRITICAL] Rancher vulnerable to Privilege Escalation via manipulation of Secrets
Rancher vulnerable to Privilege Escalation via manipulation of Secrets
### Impact
A vulnerability has been identified which enables [Standard users](https://ranchermanager.docs.rancher.com/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/global-permissions) or above to elevate their permissions to Administrator in the `local` cluster.
The `local` cluster means the cluster where Rancher is installed. It is named `local` inside the list of clusters in the Rancher UI.
Standard users could leverage their existing permissions to manipulate Kubernetes secrets in the `local` cluster, resulting in the secret being deleted, but their read-level permissions to the secret being preserved. When this operation was followed-up by
GHSA
Rancher vulnerable to Privilege Escalation via manipulation of Secrets
ghsa·2023-06-06
CVE-2023-22647 [CRITICAL] CWE-267 Rancher vulnerable to Privilege Escalation via manipulation of Secrets
Rancher vulnerable to Privilege Escalation via manipulation of Secrets
### Impact
A vulnerability has been identified which enables [Standard users](https://ranchermanager.docs.rancher.com/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/global-permissions) or above to elevate their permissions to Administrator in the `local` cluster.
The `local` cluster means the cluster where Rancher is installed. It is named `local` inside the list of clusters in the Rancher UI.
Standard users could leverage their existing permissions to manipulate Kubernetes secrets in the `local` cluster, resulting in the secret being deleted, but their read-level permissions to the secret being preserved. When this operation was followed-up by
No detection rules found.
No public exploits indexed.
2023-06-01
Published