CVE-2023-32197: Rancher allows privilege escalation in Windows nodes due to Insecure Access Control Lists

A vulnerability has been identified whereby Rancher Manager deployments containing Windows nodes have weak Access Control Lists (ACL), allowing BUILTIN\Users or NT AUTHORITY\Authenticated Users to view or edit sensitive files which could lead to privilege escalation.

The affected files include binaries, scripts, configuration and log files:

C:\etc\rancher\wins\config
C:\var\lib\rancher\agent\rancher2_connection_info.json
 C:\etc\rancher\rke2\config.yaml.d\50-rancher.yaml
C:\var\lib\rancher\agent\applied\*-*-applied.plan
 C:\usr\local\bin\rke2
C:\var\lib\rancher\capr\idempotence\idempotent.sh

RKE2 nodes expand the list to include the files below:

C:\etc\rancher\node\password
 C:\var\lib\rancher\rke2\agent\logs\kubelet.log
C:\var\lib\rancher\rke2\data\v1.**.**-rke2r*-windows-amd64-*\bin\*
 C:\var\lib\rancher\rke2\bin\*

This vulnerability is exclusive to deployments that contain Windows nodes. Linux-only environments are not affected by it.

Please consult the associated MITRE ATT&CK - Technique - Exploitation for Privilege Escalation for further information about this category of attack.