Engineers at Shock Media have discovered a major vulnerability in Rancher. Rancher is software used to manage Kubernetes clusters. Due to this flaw, a user with read-only rights can bypass security and gain admin or even root rights on hosts. The issue was reported immediately to Rancher, who conducted a prompt investigation and resolved the problem (CVE-2021-36782) in versions 2.6.7 and 2.5.16.

The Managed App platform by Shock Media

Since early last year, Shock Media has had its own Managed App platform. This container platform, based on Kubernetes, is designed to relieve developers of operational tasks and to make deploying and scaling applications simple. The experience our DevOps engineers have with setting up applications in a container landscape is highly valued by our customers, but our strong focus on security is also an important reason for developers to join our Managed App platform.

Privilege escalation vulnerability in Rancher

During a routine security review of Shock Media’s Managed App platform, Marco Stuurman, DevOps engineer at Shock Media, discovered a significant vulnerability in Rancher. Marco found that a regular read-only user within Rancher could read more information than should be possible. By extracting the right information and exploiting it in a specific way, the user can obtain elevated rights within the cluster and even perform so-called “privileged deployments.” Ultimately, it is possible through this vulnerability to gain administrator or even root rights on the hosts and access (information on) other Kubernetes clusters.

Reporting and handling by Rancher

After discovery, the vulnerability was validated by two other engineers. Once validated, the vulnerability was reported to Rancher in a responsible and secure manner, using an encrypted report and Proof-of-Concept. Rancher quickly confirmed the vulnerability and responded appropriately by launching an investigation. According to Rancher’s developer, the vulnerability is present in supported versions 2.5.15 and 2.6.6. The vulnerability, which was given CVE number CVE-2021-36782, has a CVSS score of 9.9 and is therefore considered very critical. On 19-08-2022, Rancher released a patch (version 2.6.7 and 2.5.16) that resolves the vulnerability. More information about the vulnerability and the patch can be found on Rancher’s Github page and will also be available on the Rancher Website.

Advice and solutions

Of course, we have also taken immediate measures ourselves to reduce the risk of misuse of this vulnerability on our Managed App platform and have applied the released patch. To fix the vulnerability, we also advise other administrators to update Rancher to version 2.6.7 or 2.5.16 as soon as possible. In addition, it is best practice to restrict access to the Rancher management interface as much as possible and only make it accessible to trusted administrators.

Want to know more about our Managed App platform?

Curious about the benefits and possibilities of joining our Managed App platform? Feel free to contact us for a no-obligation introduction!