CVE-2019-12303

Vulnerability

Overview

CVE-2019-12303 is an injection vulnerability in Rancher's fluentd configuration. Project owners, who have limited privileges within their project, can inject additional fluentd settings that are processed by the fluentd container [1][2]. This injection occurs because the system does not properly sanitize or restrict the configuration inputs that project owners can provide.

Exploitation and

Attack Surface

To exploit this vulnerability, an attacker must have a project owner role in a Rancher environment. No additional authentication is required beyond the existing project owner credentials. The attacker can inject arbitrary fluentd configuration directives, which are then executed by the fluentd container without further validation [2]. The attack is performed through the Rancher UI or API, where project owners can modify fluentd settings.

Impact

Successful exploitation allows an attacker to read arbitrary files on the fluentd container's filesystem, which may contain sensitive information such as secrets or configuration data. Additionally, the attacker can execute arbitrary commands within the fluentd container, potentially leading to further compromise of the underlying host or other containers [1][2].

Mitigation

The vulnerability is fixed in Rancher version 2.2.4 [1]. Users are advised to upgrade to this version or later. There are no known workarounds, so upgrading is necessary to remediate the issue.