Overview

A critical vulnerability, identified as CVE-2024-58260, has been discovered in Rancher Manager. This vulnerability allows users with update permissions on other User resources to cause denial of access for targeted accounts. The issue arises due to missing server-side validation on the `.username` field. Such a vulnerability poses a potential threat to the system’s security and data integrity.

Vulnerability Summary

CVE ID: CVE-2024-58260
Severity: Critical; CVSS Score: 7.6
Attack Vector: Network
Privileges Required: Low
User Interaction: Required
Impact: Possible system compromise and data leakage

Affected Products

Product | Affected Versions

Rancher Manager | All versions before the patch

How the Exploit Works

An attacker with update permissions on other User resources can exploit this vulnerability. The attacker fills the `.username` field with specially crafted entries, which due to the missing server-side validation, can cause denial of access for the specified user. This can potentially lead to unauthorized system access or data leakage.

Conceptual Example Code

An attacker might exploit the vulnerability with a malicious HTTP request similar to the following:

PUT /v3/users/{userId} HTTP/1.1
Host: rancher.example.com
Content-Type: application/json
{
"username": "targeted_username",
"accessMode": "blocked"
}

In this conceptual example, the attacker sends a PUT request to the user update endpoint with the targeted_username and sets the accessMode to ‘blocked’. As a result, the targeted user is denied access to their account.
Note: This is a conceptual example and may not directly apply to the vulnerable system. The actual exploit might differ based on the system configuration and the attacker’s approach.