A command injection vulnerability in the Rancher Manager cluster before 2.14.2 import endpoint /v3/import/{token}_{clusterId}.yaml through unsanitized YAML parameters could allow remote attackers to break out of an image, and execute e.g. malicious containers.

Affected: Go: github.com/rancher/rancher

### Impact A critical command injection vulnerability has been identified in the Rancher Manager cluster import endpoint `/v3/import/{token}_{clusterId}.yaml` through unsanitized YAML parameters. This endpoint accepts an `authImage` query parameter that is rendered without sanitization into a generated Kubernetes manifest template. By including URL-encoded newlines in the parameter value, an attacker can break out of the `image:` field to inject arbitrary YAML keys and malicious configurations, such as commands to execute malicious containers.

Exploitation of this vulnerability requires the following conditions to be met: - Attackers must obtain a valid cluster registration token (these tokens may be exposed, for example, through documentation, screenshots, or insecure communication channels). - The victim’s cluster operator must execute `kubectl apply` against a maliciously crafted URL.

When a victim applies this compromised manifest using `kubectl apply`, a DaemonSet is deployed with the injected configuration. This DaemonSet: - Runs on all control-plane nodes with `hostNetwork: true` enabled. - Uses the `cattle` service account, which possesses `cluster-admin` privileges. - Mounts `/etc/kubernetes` directly from the host. - Executes attacker-controlled commands via the injected `command:` field.

An attacker who successfully exploits this vulnerability could:

- Achieve full control over downstream Kubernetes clusters. - Execute arbitrary code on control-plane nodes w…

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Rancher ausnutzen, um seine Privilegien zu erhöhen, Befehle zu injizieren und um Sicherheitsmechanismen zu umgehen.