x/vulndb: potential Go vuln in github.com/rancher/rancher: GHSA-7m72-mh5r-6j3r

[GoVulnBot]

In GitHub Security Advisory GHSA-7m72-mh5r-6j3r, there is a vulnerability in the following Go packages or modules:

Unit	Fixed	Vulnerable Ranges
github.com/rancher/rancher	2.6.10	>= 2.6.0, < 2.6.10

Cross references:

• Module github.com/rancher/rancher appears in issue x/vulndb: potential Go vuln in github.com/rancher/rancher: GHSA-wm2r-rp98-8pmh #439 EFFECTIVELY_PRIVATE
• Module github.com/rancher/rancher appears in issue x/vulndb: potential Go vuln in github.com/rancher/rancher: CVE-2022-21951 #464 EFFECTIVELY_PRIVATE
• Module github.com/rancher/rancher appears in issue x/vulndb: potential Go vuln in github.com/rancher/rancher: GHSA-4fc7-hc63-7fjg #551 EFFECTIVELY_PRIVATE
• Module github.com/rancher/rancher appears in issue x/vulndb: potential Go vuln in github.com/rancher/rancher: GHSA-hx8w-ghh8-r4xf #605 EFFECTIVELY_PRIVATE
• Module github.com/rancher/rancher appears in issue x/vulndb: potential Go vuln in github.com/rancher/rancher: GHSA-jwvr-vv7p-gpwq, CVE-2021-36784 #610 EFFECTIVELY_PRIVATE
• Module github.com/rancher/rancher appears in issue x/vulndb: potential Go vuln in github.com/rancher/rancher: GHSA-9qq2-xhmc-h9qr #644 EFFECTIVELY_PRIVATE
• Module github.com/rancher/rancher appears in issue x/vulndb: potential Go vuln in github.com/rancher/rancher: CVE-2021-36782 #973 EFFECTIVELY_PRIVATE
• Module github.com/rancher/rancher appears in issue x/vulndb: potential Go vuln in github.com/rancher/rancher: CVE-2021-36783 #974 EFFECTIVELY_PRIVATE
• Module github.com/rancher/rancher appears in issue x/vulndb: potential Go vuln in github.com/rancher/rancher: CVE-2022-31247 #975 EFFECTIVELY_PRIVATE
• Module github.com/rancher/rancher appears in issue x/vulndb: potential Go vuln in github.com/rancher/rancher/server: GHSA-xhg2-rvm8-w2jh #755

See doc/triage.md for instructions on how to triage this report.

modules:
  - module: github.com/rancher/rancher
    versions:
      - introduced: 2.6.0
        fixed: 2.6.10
    packages:
      - package: github.com/rancher/rancher
  - module: github.com/rancher/rancher
    versions:
      - introduced: 2.5.0
        fixed: 2.5.17
    packages:
      - package: github.com/rancher/rancher
description: "### Impact\n\nAn issue was discovered in Rancher versions from 2.5.0
    up to and including 2.5.16 and from 2.6.0 up to and including 2.6.9, where an
    authorization logic flaw allows privilege escalation via project role template
    binding (PRTB) and `-promoted` roles. This issue is not present in Rancher 2.7
    releases.\n\nNote: Consult Rancher [documentation](https://ranchermanager.docs.rancher.com/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/cluster-and-project-roles)
    for more information about cluster and project roles and [KB 000020097](https://www.suse.com/support/kb/doc/?id=000020097)
    for information about `-promoted` roles.\n\nThis privilege escalation is possible
    for users with access to the `escalate` verb on PRTBs (`projectroletemplatebindings.management.cattle.io`),
    including users with `*` verbs on PRTBs (see notes below for more information).
    These users can escalate permissions for any `-promoted` resource (see the table
    below for a full enumeration) in any cluster where they have a PRTB granting such
    permissions in at least one project in the cluster.\n\nOn a default Rancher setup,
    only the following roles have such permissions:\n\n1. Project Owner\n2. Manage
    Project Members\n\nThese roles have permissions to affect the following resources:\n\n|
    Resource | API Group | Affected Rancher version |\n| - | - | - |\n| navlinks |
    ui.cattle.io | 2.6 |\n| nodes | \"\" | 2.6 |\n| persistentvolumes | \"\" | 2.5,
    2.6 |\n| persistentvolumes | core | 2.5, 2.6 |\n| storageclasses | storage.k8s.io
    | 2.5, 2.6 |\n| apiservices | apiregistration.k8s.io | 2.5, 2.6 |\n| clusterrepos
    | catalog.cattle.io | 2.5, 2.6 |\n| clusters (`local` only) | management.cattle.io
    | 2.5, 2.6 |\n\nNotes:\n\n1. During the calculation of the CVSS score, `privileges
    required` was considered  as `high` because, by default, `standard user` and `user-base`
    users in Rancher do not have  `create`, `patch` and `update` permissions on `roletemplates`.\n2.
    If a role template with access to those objects was already created by another
    user in the cluster, then this issue can be exploited by users without the mentioned
    permissions from point 1.\n\n### Workarounds\n\nIf updating Rancher to a patched
    version is not possible, then the following workarounds must be observed to mitigate
    this issue:\n\n1. Only grant Project Owner and Manage Project Members roles to
    trusted users.\n5. Minimize the creation of custom roles that contain the `escalate`,
    `*` or write verbs (`create`, `delete`, `patch`, `update`) on `projectroletemplatebindings`
    resource, and only grant such custom roles to trusted users.\n6. Minimize the
    number of users that have permissions to `create`, `patch` and `update` `roletemplates`.\n\n###
    Patches\n\nPatched versions include releases 2.5.17 and 2.6.10 and later versions.
    This issue is not present in Rancher 2.7 releases.\n\n### Detection\n\nThe following
    script was developed to list role template bindings that give written access to
    the affected resources listed above. It is highly recommended to run the script
    in your environment and review the list of identified roles and role template
    bindings for possible signs of exploitation of this issue. The script requires
    `jq` installed and a `kubeconfig` with access to Rancher local cluster; it can
    also be executed in Rancher's kubectl shell.\n\n```shell\n#!/bin/bash\n\nhelp=\"\nUsage:
    bash find_promoted_resource.sh \\n \\n\n\nRequires: \\n\n- jq installed and on
    path \\n\n- A kubeconfig pointing at rancher's local cluster (can also run from
    rancher's kubectl shell) \\n \\n\n\nOutputs a list of roletemplates and roletemplate
    bindings which give write access to promoted resources.\n\"\n\nif [[ $1 == \"-h\"
    || $1 == \"--help\" ]]\nthen\n\techo -e $help\n\texit 0\nfi\n\n# first, get the
    current roletemplates so that we only issue a get once\nkubectl get roletemplates.management.cattle.io
    -o json >> script_templates.json\n\n# find roles which have write access to a
    promoted resource. Filter on roleTemplates which fulfill all requirements:\n#
    Have a project context\n# Have some rules\n# Have one/more of the target api groups,
    or a * in the api groups\n# Have one/more of the target resources, or a * in the
    resources\n# Have a verb that is not read access (i.e. a verb that is not get/list/watch)\nroles=$(jq
    --argjson apiGroups '[\"\", \"ui.cattle.io\", \"core\", \"storage.k8s.io\", \"apiregistration.k8s.io\",
    \"catalog.cattle.io\", \"management.cattle.io\"]' --argjson resources '[\"navlinks\",
    \"persistentvolumes\", \"nodes\", \"storageclasses\", \"apiservices\", \"clusterrepos\",
    \"clusters\"]' --argjson verbs '[\"get\", \"list\", \"watch\"]' '.items[] | select(.context==\"project\"
    and (.rules | length >= 1)) | select( .rules[] | select( (($apiGroups - .apiGroups
    | length < 7) or (.apiGroups | index(\"*\"))) and (($resources - .resources |
    length < 7) or (.resources | index(\"*\"))) and (.verbs - $verbs  | length > 0))
    | length >= 1 ) | .metadata.name' script_templates.json | jq -s )\n\n# log promoted
    roles which give direct write access so they can be easily fixed\necho \"The following
    role templates give direct write access to a promoted resource:\"\necho $roles\necho
    -e \"\"\n\n# find any roles which inherit first-level roles. Mostly a BFS which
    radiates outward from the known bad roles \nold_roles=\"[]\"\nnew_roles=\"$roles\"\nold_length=$(echo
    $old_roles | jq 'length')\nnew_length=$(echo $new_roles | jq 'length')\n# if our
    last loop found nothing new, it's safe to stop\nwhile [[ $old_length != $new_length
    ]];\ndo\n\t# set old values to what we currently know about\n\told_roles=$new_roles\n\told_length=$new_length\n\t#
    update new values with anything that inherits a \"bad\" role we know about\n\tnew_roles=$(jq
    --argjson roles \"$old_roles\" --argjson roleLen \"$old_length\" '.items[] | .metadata.name
    as $NAME | select (( $roles | index($NAME)) or ((.roleTemplateNames | length >
    0 ) and ($roles - .roleTemplateNames | length < $roleLen))) | .metadata.name '
    script_templates.json | jq -s)\n\tnew_length=$(echo $new_roles | jq 'length')\ndone\n\nroles=$new_roles\n\n#
    log all roles which can give write access, even if it's not first level\necho
    -e \"The following role templates give write access to a promoted resource directly
    or through inheritance:\"\necho $roles\necho -e \"\"\n\nkubectl get projectroletemplatebindings.management.cattle.io
    -A -o json >> script_bindings.json\nrole_template_bindings=$(jq --argjson roleTemplates
    \"$roles\" '.items[] | .roleTemplateName as $TemplateName | select($roleTemplates
    | index($TemplateName)) | .metadata.name' script_bindings.json | jq -s)\n\n# since
    these bindings could be for users or groups, we need to include all fields which
    could help identify the subject. But they won't all be present, which makes the
    list look less pretty\necho -e \"The following is a list of bindings which give
    access to promoted resource, with the format of: bindingName, projectName, userName,
    userPrincipalName, groupName, groupPrincipalName: \"\necho $(jq --argjson bindings
    \"$role_template_bindings\" '.items[] | .metadata.name as $BindingName | select
    ( $bindings | index($BindingName)) | .metadata.name, .projectName, .userName?,
    .userPrincipalName?, .groupName?, .groupPrincipalName?' script_bindings.json |
    jq -s)\n\nunset old_roles\nunset new_roles\nunset roles\nunset role_template_bindings\nrm
    script_templates.json\nrm script_bindings.json\n```\n\n### For more information\n\nIf
    you have any questions or comments about this advisory:\n\n* Reach out to [SUSE
    Rancher Security team](https://github.com/rancher/rancher/security/policy) for
    security related inquiries.\n* Open an issue in [Rancher](https://github.com/rancher/rancher/issues/new/choose)
    repository.\n* Verify our [support matrix](https://www.suse.com/suse-rancher/support-matrix/all-supported-versions/)
    and [product support lifecycle](https://www.suse.com/lifecycle/)."
cves:
  - CVE-2022-43759
ghsas:
  - GHSA-7m72-mh5r-6j3r

[gopherbot]

Change https://go.dev/cl/466475 mentions this issue: data/excluded: batch add GO-2023-1527, GO-2023-1524, GO-2023-1516, GO-2023-1514, GO-2023-1513, GO-2023-1511, GO-2023-1523, GO-2023-1522, GO-2023-1520, GO-2023-1512

[gopherbot]

Change https://go.dev/cl/592759 mentions this issue: data/reports: unexclude 75 reports