Vulnerability-Lookup

CVE-2023-32192 (GCVE-0-2023-32192)

Vulnerability from cvelistv5 – Published: 2024-10-16 12:23 – Updated: 2024-10-16 17:25

Title

Rancher API Server Cross-site Scripting Vulnerability

Summary

A vulnerability has been identified in which unauthenticated cross-site scripting (XSS) in the API Server's public API endpoint can be exploited, allowing an attacker to execute arbitrary JavaScript code in the victim browser

Severity

8.3 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-10-16 15:55 UTC

CWE

CWE-80 - Improper Neutralization of Script-Related HTML Tags in a Web Page

Assigner

suse mitre root

References

2 references

URL	Tags
https://bugzilla.suse.com/show_bug.cgi?id=CVE-202…
https://github.com/rancher/apiserver/security/adv…

Impacted products

2 products

Vendor	Product	Version	CPE status
SUSE	apiserver	Affected: 0 , < 0.0.0-20240207153957-4fd7d821d952 (semver)	guessed
kubernetes	apiserver	Affected: 0 , < 0.0.0-20240207153957-4fd7d821d952 (semver) cpe:2.3:a:kubernetes:apiserver::::::::

Date Public

2024-02-08 17:46

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:kubernetes:apiserver:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "apiserver",
            "vendor": "kubernetes",
            "versions": [
              {
                "lessThan": "0.0.0-20240207153957-4fd7d821d952",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-32192",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-16T15:55:37.814475Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-16T17:25:48.514Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageName": "github.com/rancher/apiserver",
          "product": "apiserver",
          "vendor": "SUSE",
          "versions": [
            {
              "lessThan": "0.0.0-20240207153957-4fd7d821d952",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "datePublic": "2024-02-08T17:46:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A vulnerability has been identified in which unauthenticated cross-site \nscripting (XSS) in the API Server\u0027s public API endpoint can be \nexploited, allowing an attacker to execute arbitrary JavaScript code in the victim browser\u003cbr\u003e"
            }
          ],
          "value": "A vulnerability has been identified in which unauthenticated cross-site \nscripting (XSS) in the API Server\u0027s public API endpoint can be \nexploited, allowing an attacker to execute arbitrary JavaScript code in the victim browser"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-80",
              "description": "CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-10-16T12:23:17.271Z",
        "orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
        "shortName": "suse"
      },
      "references": [
        {
          "url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-32192"
        },
        {
          "url": "https://github.com/rancher/apiserver/security/advisories/GHSA-833m-37f7-jq55"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Rancher API Server Cross-site Scripting Vulnerability",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
    "assignerShortName": "suse",
    "cveId": "CVE-2023-32192",
    "datePublished": "2024-10-16T12:23:17.271Z",
    "dateReserved": "2023-05-04T08:30:59.322Z",
    "dateUpdated": "2024-10-16T17:25:48.514Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-32192",
      "date": "2026-09-23",
      "epss": "0.00352",
      "percentile": "0.28969"
    },
    "fkie_nvd": {
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability has been identified in which unauthenticated cross-site \nscripting (XSS) in the API Server\u0027s public API endpoint can be \nexploited, allowing an attacker to execute arbitrary JavaScript code in the victim browser"
        },
        {
          "lang": "es",
          "value": "Se ha identificado una vulnerabilidad en la que se pueden explotar cross-site scripting (XSS) no autenticadas en el endpoint de la API p\u00fablica del servidor API, lo que permite a un atacante ejecutar c\u00f3digo JavaScript arbitrario en el navegador de la v\u00edctima."
        }
      ],
      "id": "CVE-2023-32192",
      "lastModified": "2024-10-16T16:38:14.557",
      "metrics": {
        "cvssMetricV31": [
          {
            "cvssData": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "LOW",
              "baseScore": 8.3,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L",
              "version": "3.1"
            },
            "exploitabilityScore": 2.8,
            "impactScore": 5.5,
            "source": "meissner@suse.de",
            "type": "Secondary"
          }
        ]
      },
      "published": "2024-10-16T13:15:12.297",
      "references": [
        {
          "source": "meissner@suse.de",
          "url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-32192"
        },
        {
          "source": "meissner@suse.de",
          "url": "https://github.com/rancher/apiserver/security/advisories/GHSA-833m-37f7-jq55"
        }
      ],
      "sourceIdentifier": "meissner@suse.de",
      "vulnStatus": "Awaiting Analysis",
      "weaknesses": [
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-80"
            }
          ],
          "source": "meissner@suse.de",
          "type": "Secondary"
        }
      ]
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "packageName": "github.com/rancher/apiserver",
                "product": "apiserver",
                "vendor": "SUSE",
                "versions": [
                  {
                    "lessThan": "0.0.0-20240207153957-4fd7d821d952",
                    "status": "affected",
                    "version": "0",
                    "versionType": "semver"
                  }
                ]
              }
            ],
            "source": "meissner@suse.de"
          },
          {
            "affectedData": [
              {
                "cpes": [
                  "cpe:2.3:a:kubernetes:apiserver:*:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "apiserver",
                "vendor": "kubernetes",
                "versions": [
                  {
                    "lessThan": "0.0.0-20240207153957-4fd7d821d952",
                    "status": "affected",
                    "version": "0",
                    "versionType": "semver"
                  }
                ]
              }
            ],
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "A vulnerability has been identified in which unauthenticated cross-site \nscripting (XSS) in the API Server\u0027s public API endpoint can be \nexploited, allowing an attacker to execute arbitrary JavaScript code in the victim browser"
          },
          {
            "lang": "es",
            "value": "Se ha identificado una vulnerabilidad en la que se pueden explotar cross-site scripting (XSS) no autenticadas en el endpoint de la API p\u00fablica del servidor API, lo que permite a un atacante ejecutar c\u00f3digo JavaScript arbitrario en el navegador de la v\u00edctima."
          }
        ],
        "id": "CVE-2023-32192",
        "lastModified": "2026-06-17T05:58:17.240",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "LOW",
                "baseScore": 8.3,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 5.5,
              "source": "meissner@suse.de",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2023-32192",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-16T15:55:37.814475Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-10-16T13:15:12.297",
        "references": [
          {
            "source": "meissner@suse.de",
            "url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-32192"
          },
          {
            "source": "meissner@suse.de",
            "url": "https://github.com/rancher/apiserver/security/advisories/GHSA-833m-37f7-jq55"
          }
        ],
        "sourceIdentifier": "meissner@suse.de",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-80"
              }
            ],
            "source": "meissner@suse.de",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2025-05-28T23:00:47+00:00",
      "cve": "CVE-2023-32192",
      "id": "CVE-2023-32192",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "Rancher API Server Cross-site Scripting Vulnerability",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-32192.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2025-02-16T06:19:53Z",
      "cve": "CVE-2023-32192",
      "id": "CVE-2023-32192",
      "initial_release_date": "2024-02-09T03:03:57Z",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2023-32192",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2023-32192.json",
      "version": "7"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "affected": [
              {
                "cpes": [
                  "cpe:2.3:a:kubernetes:apiserver:*:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "apiserver",
                "vendor": "kubernetes",
                "versions": [
                  {
                    "lessThan": "0.0.0-20240207153957-4fd7d821d952",
                    "status": "affected",
                    "version": "0",
                    "versionType": "semver"
                  }
                ]
              }
            ],
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2023-32192",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-10-16T15:55:37.814475Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-10-16T16:25:36.703Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "packageName": "github.com/rancher/apiserver",
              "product": "apiserver",
              "vendor": "SUSE",
              "versions": [
                {
                  "lessThan": "0.0.0-20240207153957-4fd7d821d952",
                  "status": "affected",
                  "version": "0",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "datePublic": "2024-02-08T17:46:00.000Z",
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "A vulnerability has been identified in which unauthenticated cross-site \nscripting (XSS) in the API Server\u0027s public API endpoint can be \nexploited, allowing an attacker to execute arbitrary JavaScript code in the victim browser\u003cbr\u003e"
                }
              ],
              "value": "A vulnerability has been identified in which unauthenticated cross-site \nscripting (XSS) in the API Server\u0027s public API endpoint can be \nexploited, allowing an attacker to execute arbitrary JavaScript code in the victim browser"
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "LOW",
                "baseScore": 8.3,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-80",
                  "description": "CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2024-10-16T12:23:17.271Z",
            "orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
            "shortName": "suse"
          },
          "references": [
            {
              "url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-32192"
            },
            {
              "url": "https://github.com/rancher/apiserver/security/advisories/GHSA-833m-37f7-jq55"
            }
          ],
          "source": {
            "discovery": "UNKNOWN"
          },
          "title": "Rancher API Server Cross-site Scripting Vulnerability",
          "x_generator": {
            "engine": "Vulnogram 0.1.0-dev"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
        "assignerShortName": "suse",
        "cveId": "CVE-2023-32192",
        "datePublished": "2024-10-16T12:23:17.271Z",
        "dateReserved": "2023-05-04T08:30:59.322Z",
        "dateUpdated": "2024-10-16T17:25:48.514Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

FKIE_CVE-2023-32192

Vulnerability from fkie_nvd - Published: 2024-10-16 13:15 - Updated: 2026-06-17 05:58

Severity

8.3 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L

Summary

References

	URL	Tags
	meissner@suse.de	https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-32192
	meissner@suse.de	https://github.com/rancher/apiserver/security/advisories/GHSA-833m-37f7-jq55

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "packageName": "github.com/rancher/apiserver",
          "product": "apiserver",
          "vendor": "SUSE",
          "versions": [
            {
              "lessThan": "0.0.0-20240207153957-4fd7d821d952",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "meissner@suse.de"
    },
    {
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:kubernetes:apiserver:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unknown",
          "product": "apiserver",
          "vendor": "kubernetes",
          "versions": [
            {
              "lessThan": "0.0.0-20240207153957-4fd7d821d952",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability has been identified in which unauthenticated cross-site \nscripting (XSS) in the API Server\u0027s public API endpoint can be \nexploited, allowing an attacker to execute arbitrary JavaScript code in the victim browser"
    },
    {
      "lang": "es",
      "value": "Se ha identificado una vulnerabilidad en la que se pueden explotar cross-site scripting (XSS) no autenticadas en el endpoint de la API p\u00fablica del servidor API, lo que permite a un atacante ejecutar c\u00f3digo JavaScript arbitrario en el navegador de la v\u00edctima."
    }
  ],
  "id": "CVE-2023-32192",
  "lastModified": "2026-06-17T05:58:17.240",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 8.3,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.5,
        "source": "meissner@suse.de",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-32192",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2024-10-16T15:55:37.814475Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2024-10-16T13:15:12.297",
  "references": [
    {
      "source": "meissner@suse.de",
      "url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-32192"
    },
    {
      "source": "meissner@suse.de",
      "url": "https://github.com/rancher/apiserver/security/advisories/GHSA-833m-37f7-jq55"
    }
  ],
  "sourceIdentifier": "meissner@suse.de",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-80"
        }
      ],
      "source": "meissner@suse.de",
      "type": "Secondary"
    }
  ]
}

GHSA-833M-37F7-JQ55

Vulnerability from github – Published: 2024-02-08 18:46 – Updated: 2024-10-16 17:25

Summary

Rancher API Server Cross-site Scripting Vulnerability

Details

Impact

A vulnerability has been identified in which unauthenticated cross-site scripting (XSS) in the API Server's public API endpoint can be exploited. This can lead to an attacker exploiting the vulnerability to trigger JavaScript code and execute commands remotely.

The attack vector was identified as a Reflected XSS.

API Server propagates malicious payloads from user input to the UI, which renders the output. For example, a malicious URL gets rendered into a script that is executed on a page.

The changes addressed by this fix are: - Encode input that comes from the request URL before adding it to the response. - The request input is escaped by changing the URL construction that is used for links to use url.URL. - The request input is escaped by escaping the JavaScript and CSS variables with attribute encoding as defined by OWASP.

Patches

Patched versions include the following commits:

Branch	Commit
master	4fd7d82
release/v2.8	69b3c2b
release/v2.8.s3	a3b9e37
release/v2.7	4e102cf
release/v2.7.s3	97a10a3
release/v2.6	4df268e

Workarounds

There is no direct mitigation besides updating API Server to a patched version.

References

If you have any questions or comments about this advisory:

Reach out to the SUSE Rancher Security team for security-related inquiries.
Open an issue in the Rancher repository.
Verify with our support matrix and product support lifecycle.

Severity

8.3 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/rancher/apiserver"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.0.0-20240207153957-4fd7d821d952"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-32192"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-80"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-02-08T18:46:23Z",
    "nvd_published_at": "2024-10-16T13:15:12Z",
    "severity": "HIGH"
  },
  "details": "### Impact\nA vulnerability has been identified in which unauthenticated cross-site scripting (XSS) in the API Server\u0027s public API endpoint can be exploited. This can lead to an attacker exploiting the vulnerability to trigger JavaScript code and execute commands remotely. \n\nThe attack vector was identified as a Reflected XSS.\n\nAPI Server propagates malicious payloads from user input to the UI, which renders the output. For example, a malicious URL gets rendered into a script that is executed on a page.\n\nThe changes addressed by this fix are:\n- Encode input that comes from the request URL before adding it to the response.\n- The request input is escaped by changing the URL construction that is used for links to use `url.URL`.\n- The request input is escaped by escaping the JavaScript and CSS variables with attribute encoding as defined by [OWASP](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html#output-encoding-rules-summary).\n\n### Patches\nPatched versions include the following commits:\n\n| Branch    | Commit |\n| -------- | ------- |\n| master  | 4fd7d82 |\n| release/v2.8 | 69b3c2b |\n| release/v2.8.s3 | a3b9e37 |\n| release/v2.7 | 4e102cf |\n| release/v2.7.s3 | 97a10a3 |\n| release/v2.6 | 4df268e |\n\n### Workarounds\nThere is no direct mitigation besides updating API Server to a patched version.\n\n### References\nIf you have any questions or comments about this advisory:\n\n- Reach out to the [SUSE Rancher Security team](https://github.com/rancher/rancher/security/policy) for security-related inquiries.\n- Open an issue in the [Rancher](https://github.com/rancher/rancher/issues/new/choose) repository.\n- Verify with our [support matrix](https://www.suse.com/suse-rancher/support-matrix/all-supported-versions/) and [product support lifecycle](https://www.suse.com/lifecycle/).\n",
  "id": "GHSA-833m-37f7-jq55",
  "modified": "2024-10-16T17:25:51Z",
  "published": "2024-02-08T18:46:23Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/rancher/apiserver/security/advisories/GHSA-833m-37f7-jq55"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32192"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rancher/apiserver/commit/4df268e250f625fa323349062636496e0aeff4e4"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rancher/apiserver/commit/4e102cf0d07b1af3d10d82c3e5a751a869b8a6c7"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rancher/apiserver/commit/4fd7d821d952510bfe38c9d4a3e2a65157f50525"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rancher/apiserver/commit/69b3c2b56f3fa5a421889c533dada8cd08783cda"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rancher/apiserver/commit/97a10a30200cb851afd8ee85ee6b2295c4b6e5ee"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rancher/apiserver/commit/a3b9e3721c1b558ee63aec9594e37c223a5c8437"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-32192"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/rancher/apiserver"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Rancher API Server Cross-site Scripting Vulnerability"
}

GSD-2023-32192

Vulnerability from gsd - Updated: 2023-12-13 01:20

Details

** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.

Aliases

CVE-2023-32192

Aliases

CVE-2023-32192

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2023-32192",
    "id": "GSD-2023-32192"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2023-32192"
      ],
      "id": "GSD-2023-32192",
      "modified": "2023-12-13T01:20:23.534251Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cve@mitre.org",
        "ID": "CVE-2023-32192",
        "STATE": "RESERVED"
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
          }
        ]
      }
    }
  }
}

WID-SEC-W-2024-0332

Vulnerability from csaf_certbund - Published: 2024-02-08 23:00 - Updated: 2024-02-08 23:00

Summary

Rancher: Mehrere Schwachstellen

Severity

Hoch

Scope

4 vulnerabilities in this advisory, including CVE-2023-32192.

CVE-2023-32192

In Rancher existieren mehrere Cross-Site Scripting Schwachstellen. HTML und Script-Eingaben werden in den Komponenten "Apeserver" und "Norman" nicht ordnungsgemäß überprüft, bevor sie an den Benutzer zurückgegeben werden. Ein entfernter, anonymer Angreifer kann durch Ausnutzung dieser Schwachstellen beliebigen HTML- und Script-Code durch den Browser des Benutzers im Kontext der betroffenen Seite ausführen. Zur erfolgreichen Ausnutzung ist eine Benutzeraktion erforderlich.

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2023-32192 (GCVE-0-2023-32192)

FKIE_CVE-2023-32192

GHSA-833M-37F7-JQ55

Impact

Patches

Workarounds

References

GSD-2023-32192

WID-SEC-W-2024-0332

Tags

Sightings

Nomenclature

Related by attack behaviour