Path Traversal in Rancher Fleet ImageScan

Executive Summary

This vulnerability is a path traversal issue found in Fleet's ImageScan subsystem, specifically in the GitRepo path handler. It occurs because the Fleet controller processes paths specified in gitrepo.Spec.Paths without verifying that these paths remain within the cloned repository directory.

An authenticated user with permission to create or modify GitRepo resources in a Fleet-managed namespace can exploit this by supplying path-traversal sequences (like ../etc) in the spec.paths. This causes the ImageScan controller to access directories outside the intended workspace, leading to resource exhaustion and denial of service.

Useful 0 Not Useful 0

Impact Analysis

Exploiting this vulnerability can cause a denial of service by exhausting system resources and blocking all other ImageScan operations across all tenants. This happens because the ImageScan controller holds a global mutex while recursively walking directories outside the intended repository workspace.

The attacker must have Kubernetes RBAC permission to create or modify GitRepo resources, so the impact is limited to users with such permissions. However, once exploited, it can disrupt the availability of ImageScan services for all users.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves a path traversal in Fleet's ImageScan subsystem triggered by processing malicious GitRepo paths. Detection involves checking for unusual or unauthorized modifications or creations of GitRepo resources in Fleet-managed namespaces, especially those containing path-traversal sequences like '../'.

Since the attacker must have Kubernetes RBAC permission to create or modify GitRepo resources, you can audit Kubernetes API server logs or use kubectl commands to list GitRepo resources and inspect their spec.paths fields for suspicious entries.

• Use kubectl to list GitRepo resources in Fleet-managed namespaces: kubectl get gitrepo -n <namespace> -o yaml
• Inspect the spec.paths fields for path traversal sequences (e.g., '../etc'): kubectl get gitrepo -n <namespace> -o jsonpath='{.items[*].spec.paths}'
• Audit Kubernetes API server logs for creation or modification of GitRepo resources with suspicious paths.

Additionally, monitoring for denial of service symptoms related to ImageScan operations being blocked or resource exhaustion on the Fleet controller may indicate exploitation attempts.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include applying patches and configuration changes to prevent exploitation of the path traversal vulnerability in Fleet's ImageScan subsystem.

• Upgrade Fleet to a patched version: v0.15.3, v0.14.7, v0.13.12, or v0.12.16 or later.
• If upgrading is not immediately possible and you are using Fleet v0.15 or later, disable the ImageScan controller by setting imagescan.enabled=false in the Helm chart.
• Restrict Kubernetes RBAC permissions to prevent unauthorized users from creating or modifying GitRepo resources in Fleet-managed namespaces.

These steps will prevent attackers from exploiting the vulnerability by limiting their ability to supply malicious paths and stopping the vulnerable ImageScan processing.

Useful 0 Not Useful 0