Rancher agents can be hijacked by taking over the Rancher Server URL
Date: 2024-09
Affected: go/github.com/rancher/rancher, go/github.com/rancher/rancher, go/github.com/rancher/rancher
Attack vector: other
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2024-22030
CWE: CWE-295
CVSS: 8 (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H)

### Impact A vulnerability has been identified within Rancher that can be exploited in narrow circumstances through a man-in-the-middle (MITM) attack. An attacker would need to have control of an expired domain or execute a DNS spoofing/hijacking attack against the domain to exploit this vulnerability. The targeted domain is the one used as the Rancher URL. SUSE is unaware of any successful exploitation of this vulnerability, which has a high complexity bar. Please consult the associated [MITRE ATT&CK - Technique - Adversary-in-the-Middle](https://attack.mitre.org/techniques/T1557/) for further information about this attack category. ### Patches A new setting, [`agent-tls-mode`](https://ranchermanager.docs.rancher.com/getting-started/installation-and-upgrade/installation-references/tls-settings), was added, which allows users to specify if agents will use `strict` certificate verification when connecting to Rancher. The field can be set to `strict` (which requires the agent to verify the certificate using only the Certificate Authority in the `cacerts` setting) or `system-store` (which allows the agent to verify the certificate using any Certificate Authority in the operating system's trust store). This setting will default to strict on new installs of Rancher `v2.8.6`, `v2.9.0`, and newer versions. When upgrading from a prior version, the current value will be kept. If updating from older versions, the settings must be manually configured. **Important:** For non-Window


Mitigations:

Architectural layers (MAESTRO):