[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"cve-CVE-2023-22647":3},{"id":4,"cve_id":5,"euvd_id":6,"summary":7,"published":8,"cvss_data":9,"is_remote":20,"cwes":21,"cpes":25,"technologies":115,"references":118,"score":125,"epss_score":126,"epss_percentile":127,"is_kev":128,"cisa_kev_date_added":129,"cisa_kev_due_date":129,"cisa_ssvc":130,"attack_mappings":140,"exploits":193},335938,"CVE-2023-22647","EUVD-2023-1854","Rancher vulnerable to Privilege Escalation via manipulation of Secrets\n\n### Impact\n\nA vulnerability has been identified which enables [Standard users](https:\u002F\u002Franchermanager.docs.rancher.com\u002Fhow-to-guides\u002Fnew-user-guides\u002Fauthentication-permissions-and-global-configuration\u002Fmanage-role-based-access-control-rbac\u002Fglobal-permissions) or above to elevate their permissions to Administrator in the `local` cluster.\n\nThe `local` cluster means the cluster where Rancher is installed. It is named `local` inside the list of clusters in the Rancher UI.\n\nStandard users could leverage their existing permissions to manipulate Kubernetes secrets in the `local` cluster, resulting in the secret being deleted, but their read-level permissions to the secret being preserved. When this operation was followed-up by other specially crafted commands, it could result in the user gaining access to tokens belonging to service accounts in the `local` cluster.\n\nUsers that have custom global roles which grant `create` and `delete` permissions on `secrets` would also be able to exploit this vulnerability.\n\nUsers with [audit logs enabled](https:\u002F\u002Franchermanager.docs.rancher.com\u002Fhow-to-guides\u002Fadvanced-user-guides\u002Fenable-api-audit-log#enabling-api-audit-log) in Rancher can try to identify possible abuses of this issue by going through the logs. To sieve through the data filter by `kind: Secret` with `type: provisioning.cattle.io\u002Fcloud-credential`, then investigate all log entries that affect that specific resource. A secondary check would be to filter by all operations with `Opaque` Secrets within the `cattle-global-data` namespace.\n\nAfter patching, it is recommended that users review access methods to Rancher (including RBAC policies, tokens, and host-level node access), to ensure that no changes were made to persist access to users who have leveraged this vulnerability.\n\n### Patches\n\nPatched versions include releases `2.6.13`, `2.7.4` and later versions. \n\n### Workarounds\n\nThere is no direct mitigation besides updating Rancher to a patched version.\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n- Reach out to the [SUSE Rancher Security team](https:\u002F\u002Fgithub.com\u002Francher\u002Francher\u002Fsecurity\u002Fpolicy) for security related inquiries.\n- Open an issue in the [Rancher](https:\u002F\u002Fgithub.com\u002Francher\u002Francher\u002Fissues\u002Fnew\u002Fchoose) repository.\n- Verify with our [support matrix](https:\u002F\u002Fwww.suse.com\u002Fsuse-rancher\u002Fsupport-matrix\u002Fall-supported-versions\u002F) and [product support lifecycle](https:\u002F\u002Fwww.suse.com\u002Flifecycle\u002F).","2023-06-06T02:00:00Z",{"cvss_v3.1":10},{"scope":11,"version":12,"baseScore":13,"attackVector":14,"baseSeverity":15,"vectorString":16,"integrityImpact":17,"userInteraction":18,"attackComplexity":19,"availabilityImpact":17,"privilegesRequired":19,"confidentialityImpact":17},"CHANGED","3.1",9.9,"NETWORK","CRITICAL","CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:C\u002FC:H\u002FI:H\u002FA:H","HIGH","NONE","LOW",true,[22,23,24],"CWE-267","NVD-CWE-Other","CWE-269",[26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114],"cpe:2.3:a:suse:rancher:2.6.2:rc2:*:*:*:*:*:*","cpe:2.3:a:suse:rancher:2.6.4:rc14:*:*:*:*:*:*","cpe:2.3:a:suse:rancher:2.6.4:rc4:*:*:*:*:*:*","cpe:2.3:a:suse:rancher:2.7.1:rc5:*:*:*:*:*:*","cpe:2.3:a:suse:rancher:2.6.4:rc2:*:*:*:*:*:*","cpe:2.3:a:suse:rancher:2.6.2:rc1:*:*:*:*:*:*","cpe:2.3:a:suse:rancher:2.7.1:rc8:*:*:*:*:*:*","cpe:2.3:a:suse:rancher:2.6.4:rc13:*:*:*:*:*:*","cpe:2.3:a:suse:rancher:2.6.1:rc6:*:*:*:*:*:*","cpe:2.3:a:suse:rancher:2.6.3:-:*:*:*:*:*:*","cpe:2.3:a:suse:rancher:2.6.4:rc1:*:*:*:*:*:*","cpe:2.3:a:suse:rancher:2.7.1:rc6:*:*:*:*:*:*","cpe:2.3:a:suse:rancher:2.6.4:alpha1:*:*:*:*:*:*","cpe:2.3:a:suse:rancher:2.6.3:patch2-rc2:*:*:*:*:*:*","cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*","cpe:2.3:a:suse:rancher:2.6.2:-:*:*:*:*:*:*","cpe:2.3:a:suse:rancher:2.6.4:rc7:*:*:*:*:*:*","cpe:2.3:a:suse:rancher:2.6.4:rc15:*:*:*:*:*:*","cpe:2.3:a:suse:rancher:2.6.0:rc5:*:*:*:*:*:*","cpe:2.3:a:suse:rancher:2.6.4:rc9:*:*:*:*:*:*","cpe:2.3:a:suse:rancher:2.6.1:rc4:*:*:*:*:*:*","cpe:2.3:a:suse:rancher:2.6.3:rc6:*:*:*:*:*:*","cpe:2.3:a:suse:rancher:2.6.3:patch3-rc1:*:*:*:*:*:*","cpe:2.3:a:suse:rancher:2.7.1:rc7:*:*:*:*:*:*","cpe:2.3:a:suse:rancher:2.6.3:patch3:*:*:*:*:*:*","cpe:2.3:a:suse:rancher:2.7.1:rc11:*:*:*:*:*:*","cpe:2.3:a:suse:rancher:2.6.1:rc10:*:*:*:*:*:*","cpe:2.3:a:suse:rancher:2.6.3:rc1:*:*:*:*:*:*","cpe:2.3:a:suse:rancher:2.6.3:rc3:*:*:*:*:*:*","cpe:2.3:a:suse:rancher:2.6.1:rc12:*:*:*:*:*:*","cpe:2.3:a:suse:rancher:2.6.3:rc5:*:*:*:*:*:*","cpe:2.3:a:suse:rancher:2.6.0:rc3:*:*:*:*:*:*","cpe:2.3:a:suse:rancher:2.7.1:rc10:*:*:*:*:*:*","cpe:2.3:a:suse:rancher:2.7.1:rc2:*:*:*:*:*:*","cpe:2.3:a:suse:rancher:2.6.3:patch2:*:*:*:*:*:*","cpe:2.3:a:suse:rancher:2.6.1:rc2:*:*:*:*:*:*","cpe:2.3:a:suse:rancher:2.6.0:-:*:*:*:*:*:*","cpe:2.3:a:suse:rancher:2.6.3:rc10:*:*:*:*:*:*","cpe:2.3:a:suse:rancher:2.6.1:rc3:*:*:*:*:*:*","cpe:2.3:a:suse:rancher:2.6.0:rc10:*:*:*:*:*:*","cpe:2.3:a:suse:rancher:2.6.3:patch1-rc2:*:*:*:*:*:*","cpe:2.3:a:suse:rancher:2.6.4:alpha2:*:*:*:*:*:*","cpe:2.3:a:suse:rancher:2.6.3:patch2-rc3:*:*:*:*:*:*","cpe:2.3:a:suse:rancher:2.6.1:rc1:*:*:*:*:*:*","cpe:2.3:a:suse:rancher:2.6.3:patch2-rc4:*:*:*:*:*:*","cpe:2.3:a:suse:rancher:2.6.10:*:*:*:*:*:*:*","cpe:2.3:a:suse:rancher:2.6.4:rc11:*:*:*:*:*:*","cpe:2.3:a:suse:rancher:2.6.3:patch1-rc3:*:*:*:*:*:*","cpe:2.3:a:suse:rancher:2.6.3:rc2:*:*:*:*:*:*","cpe:2.3:a:suse:rancher:2.6.1:rc7:*:*:*:*:*:*","cpe:2.3:a:suse:rancher:2.6.3:rc11:*:*:*:*:*:*","cpe:2.3:a:suse:rancher:2.6.0:rc7:*:*:*:*:*:*","cpe:2.3:a:suse:rancher:2.6.4:rc10:*:*:*:*:*:*","cpe:2.3:a:suse:rancher:2.7.1:-:*:*:*:*:*:*","cpe:2.3:a:suse:rancher:2.6.3:patch1:*:*:*:*:*:*","cpe:2.3:a:suse:rancher:2.6.4:rc5:*:*:*:*:*:*","cpe:2.3:a:suse:rancher:2.7.1:rc4:*:*:*:*:*:*","cpe:2.3:a:suse:rancher:2.7.1:rc3:*:*:*:*:*:*","cpe:2.3:a:suse:rancher:2.6.0:rc4:*:*:*:*:*:*","cpe:2.3:a:suse:rancher:2.7.0:*:*:*:*:*:*:*","cpe:2.3:a:suse:rancher:2.7.1:rc1:*:*:*:*:*:*","cpe:2.3:a:suse:rancher:2.6.3:patch2-rc1:*:*:*:*:*:*","cpe:2.3:a:suse:rancher:2.6.3:patch1-rc1:*:*:*:*:*:*","cpe:2.3:a:suse:rancher:2.6.1:rc8:*:*:*:*:*:*","cpe:2.3:a:suse:rancher:2.6.4:rc3:*:*:*:*:*:*","cpe:2.3:a:suse:rancher:2.6.3:rc7:*:*:*:*:*:*","cpe:2.3:a:suse:rancher:2.7.1:rc9:*:*:*:*:*:*","cpe:2.3:a:suse:rancher:2.6.4:rc12:*:*:*:*:*:*","cpe:2.3:a:suse:rancher:2.6.0:rc2:*:*:*:*:*:*","cpe:2.3:a:suse:rancher:2.6.1:rc5:*:*:*:*:*:*","cpe:2.3:a:suse:rancher:2.6.3:rc8:*:*:*:*:*:*","cpe:2.3:a:suse:rancher:2.6.1:-:*:*:*:*:*:*","cpe:2.3:a:suse:rancher:2.6.3:rc9:*:*:*:*:*:*","cpe:2.3:a:suse:rancher:2.6.3:rc4:*:*:*:*:*:*","cpe:2.3:a:suse:rancher:2.6.4:rc8:*:*:*:*:*:*","cpe:2.3:a:suse:rancher:2.6.1:rc13:*:*:*:*:*:*","cpe:2.3:a:suse:rancher:2.6.0:rc1:*:*:*:*:*:*","cpe:2.3:a:suse:rancher:2.6.1:rc9:*:*:*:*:*:*","cpe:2.3:a:suse:rancher:2.7.1:rc12:*:*:*:*:*:*","cpe:2.3:a:suse:rancher:2.6.4:rc6:*:*:*:*:*:*","cpe:2.3:a:suse:rancher:2.6.4:-:*:*:*:*:*:*","cpe:2.3:a:suse:rancher:2.6.0:rc6:*:*:*:*:*:*","cpe:2.3:a:suse:rancher:2.6.0:rc8:*:*:*:*:*:*","cpe:2.3:a:suse:rancher:2.6.0:rc9:*:*:*:*:*:*","cpe:2.3:a:suse:rancher:2.6.4:rc16:*:*:*:*:*:*","cpe:2.3:a:suse:rancher:2.6.1:rc11:*:*:*:*:*:*","cpe:2.3:a:suse:rancher:2.6.4:rc17:*:*:*:*:*:*","cpe:2.3:a:suse:rancher:2.6.4:alpha3:*:*:*:*:*:*","cpe:2.3:a:rancher:rancher:*:*:*:*:*:*:*:*",[116,117],"Suse Rancher","Rancher Rancher",[119,120,121,122,123,124],"https:\u002F\u002Fbugzilla.suse.com\u002Fshow_bug.cgi?id=CVE-2023-22647","https:\u002F\u002Fgithub.com\u002Francher\u002Francher\u002Fsecurity\u002Fadvisories\u002FGHSA-p976-h52c-26p6","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2023-22647","https:\u002F\u002Fgithub.com\u002Francher\u002Francher","https:\u002F\u002Fgithub.com\u002Francher\u002Francher\u002Freleases\u002Ftag\u002Fv2.6.13","https:\u002F\u002Fgithub.com\u002Francher\u002Francher\u002Freleases\u002Ftag\u002Fv2.7.4",0.7,0.00715,0.53449,false,null,{"timestamp":131,"automatable":132,"tech_impact":133,"exploitation":134,"cisa_decision":135,"cisa_remediation_timeline":139},"2025-01-09T17:00:27.899424Z","no","total","none",{"vector":136,"decision":137,"priority":138},"CISAv1\u002FE:N\u002FA:N\u002FT:T\u002FM:H\u002F2026-10-25T18:42:33.184924\u002F","track_star","medium","14D",[141,147,156,163,170,176,184],{"name":142,"source":143,"tactics":144,"technique_id":146},"Exploit Public-Facing Application","attack_vector",[145],"initial-access","T1190",{"name":148,"source":149,"cwe_ids":150,"tactics":151,"capec_ids":153,"technique_id":155},"Screen Capture","capec",[22],[152],"collection",[154],"CAPEC-648","T1113",{"name":157,"source":149,"cwe_ids":158,"tactics":159,"capec_ids":160,"technique_id":162},"Clipboard Data",[22],[152],[161],"CAPEC-637","T1115",{"name":164,"source":149,"cwe_ids":165,"tactics":166,"capec_ids":167,"technique_id":169},"Audio Capture",[22],[152],[168],"CAPEC-634","T1123",{"name":171,"source":149,"cwe_ids":172,"tactics":173,"capec_ids":174,"technique_id":175},"Video Capture",[22],[152],[168],"T1125",{"name":177,"source":149,"cwe_ids":178,"tactics":179,"capec_ids":181,"technique_id":183},"Network Share Discovery",[22],[180],"discovery",[182],"CAPEC-643","T1135",{"name":185,"source":149,"cwe_ids":186,"tactics":187,"capec_ids":189,"technique_id":192},"Abuse Elevation Control Mechanism",[24],[188],"privilege-escalation",[190,191],"CAPEC-122","CAPEC-233","T1548",[]]