Rancher Manager SAML Authentication Token Phishing – Brief Summary of CVE-2024-58267

Introduction

Attackers can steal Rancher authentication tokens by tricking users into authenticating through malicious URLs. A stolen token can give an attacker unauthorized access to Kubernetes clusters. The issue directly affects organizations that run Rancher Manager with SAML authentication enabled, and it exposes critical infrastructure to phishing-based credential theft.

About Rancher: Rancher, now part of SUSE, is a major Kubernetes management platform. Enterprises worldwide use it to orchestrate and secure containerized workloads. Its user base spans thousands of organizations, so a vulnerability in Rancher has wide reach across the cloud-native ecosystem.

Technical Information

CVE-2024-58267 affects Rancher Manager's SAML authentication flow when a user starts it from the CLI tool. The Rancher CLI generates a SAML login URL with two parameters: publicKey, which is used to encrypt the resulting authentication token, and requestId, which is used to correlate the CLI session with the web authentication flow.

The cause is insufficient validation of these parameters. Rancher Manager did not check that the publicKey and requestId in the authentication URL were legitimate and tied to an active, authorized CLI session. An attacker could therefore craft a phishing URL that carries attacker-controlled values for both parameters.

When a victim clicks such a URL and completes authentication, Rancher encrypts the authentication token with the attacker's public key and associates it with the attacker's requestId. The attacker can then decrypt the token and use it to access the Rancher environment with the victim's privileges. The attack requires SAML authentication to be enabled on the target, and the victim has to be convinced, through phishing or social engineering, to use the malicious URL.

The vulnerability is classified as CWE-345 (Insufficient Verification of Data Authenticity). Attackers do not need to compromise the Rancher server directly. The attack is entirely external and relies on user interaction.

Patch Information

The development team fixed the vulnerability with a set of updates to Rancher Manager's SAML authentication, intended to reduce the risk of phishing attacks. The updates add stricter validation to the SAML authentication process and improve how it handles authentication tokens.

Changes Implemented:

1. The system now verifies the requestId parameter in SAML authentication requests, so only legitimate authentication requests are processed. Attackers can no longer inject malicious requestId values to hijack sessions.
2. The application now validates the publicKey parameter supplied during the SAML authentication process. Attackers can no longer supply their own public keys to intercept and decrypt authentication tokens.
3. Users now see the origin and details of authentication requests. This helps them identify potentially malicious login attempts and makes them less likely to fall for phishing.

Code Implementation Details:

// Validate SAML authentication request
func validateSAMLRequest(requestId string, publicKey string) error {
    // Check if requestId is associated with an active session
    if !isValidRequestId(requestId) {
        return errors.New("Invalid or expired requestId")
    }

    // Validate the provided publicKey
    if !isValidPublicKey(publicKey) {
        return errors.New("Invalid publicKey")
    }

    // Proceed with authentication process
    return nil
}

// Function to check the validity of requestId
func isValidRequestId(requestId string) bool {
    // Implementation of requestId validation logic
}

// Function to check the validity of publicKey
func isValidPublicKey(publicKey string) bool {
    // Implementation of publicKey validation logic
}

Impact of the Patch:

These changes significantly reduce the risk of phishing attacks against the SAML authentication process. Rancher Manager now processes only legitimate authentication requests, and users are better equipped to recognize and respond to potential threats.

Recommendations for Users:

• Upgrade to a patched version of Rancher Manager. We strongly recommend this.
• Train users to recognize phishing attempts and to verify authentication requests.
• Review authentication logs regularly so you can detect and respond to suspicious activity promptly.

Patch source: GitHub Advisory GHSA-v3vj-5868-2ch2

Affected Systems and Versions

• Rancher Manager deployments with SAML authentication enabled are affected.
• Vulnerable versions include all releases before:
  • v2.12.2
  • v2.11.6
  • v2.10.10
  • v2.9.12
• All configurations that use SAML authentication through the CLI tool are vulnerable.

Vendor Security History

Rancher (SUSE) has a consistent record of responsible vulnerability disclosure and timely patching. Its previous advisories and CVEs point to a mature security process and transparent communication. For CVE-2024-58267, it published coordinated advisories and patches for all supported versions.

References

• NVD CVE-2024-58267
• Official CVE entry
• GitHub Advisory GHSA-v3vj-5868-2ch2
• SUSE Bugzilla CVE-2024-58267
• Rancher Security Advisories
• Snyk Advisory SNYK-GOLANG-GITHUBCOMRANCHERCLICMD-13053586
• OSV GHSA-v3vj-5868-2ch2