A Missing Authorization vulnerability in of SUSE Rancher allows authenticated user to create an unauthorized shell pod and kubectl access in the local cluster This issue affects: SUSE Rancher Rancher versions prior to 2.5.17; Rancher versions prior to 2.6.10; Rancher versions prior to 2.7.1.

Affected: Go: github.com/rancher/rancher

### Impact

An issue was discovered in Rancher where an authorization logic flaw allows an authenticated user on any downstream cluster to (1) open a shell pod in the Rancher `local` cluster and (2) have limited `kubectl` access to it. The expected behavior is that a user does not have such access in the Rancher `local` cluster unless explicitly granted.

This issue does not allow the user to escalate privileges in the `local` cluster directly (this would require another vulnerability to be exploited).

The security issue happens in two different ways:

1. Shell pod access - This is when a user opens a shell pod in the Rancher UI to a downstream cluster that the user has permission to access. The web request can be intercepted using the browser's web inspector/network console or a proxy tool to change the shell's destination to the Rancher `local` cluster instead of the desired downstream cluster.

- This flaw cannot be exploited to access a downstream cluster that the user has no permissions to.

- The shell pod runs with a limited non-root user, reducing the severity of this issue. However, even as a non-root user, it is still possible download and run binaries inside the shell pod.

- The blast radius of this issue can increase based on the configuration of the `local` cluster. For example:

- If the `local` cluster has unlimited network access, e.g. to the Internet, the user can open a reverse network connection to the shell pod.

- Or access the clo…

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Rancher ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Informationen offenzulegen, seine Rechte zu erweitern und Code auszuführen.