CVE-2023-32197: Rancher allows privilege escalation in Windows nodes due to Insecure Access Control Lists

October 25, 2024 (updated November 5, 2024)

A vulnerability has been identified whereby Rancher Manager deployments containing Windows nodes have weak Access Control Lists (ACL), allowing BUILTIN\Users or NT AUTHORITY\Authenticated Users to view or edit sensitive files which could lead to privilege escalation.

References

github.com/advisories/GHSA-7h8m-pvw3-5gh4
github.com/rancher/rancher
github.com/rancher/rancher/security/advisories/GHSA-7h8m-pvw3-5gh4
nvd.nist.gov/vuln/detail/CVE-2023-32197

Detect and mitigate CVE-2023-32197 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →