Incorrect Credential Retention in SUSE Rancher

Executive Summary

This vulnerability involves incorrect credential cleaning during logout in SUSE Rancher 2.15 before version 2.15.2. When a user logs out, browser session cookies are cleared but the server-side session token remains valid. This allows attackers who obtain a valid session token before logout to retain access with the victim's identity and permissions until the token expires.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check for active session tokens in Rancher's backing store after logout. Inspect logs for API requests using tokens that should have been revoked. Look for unauthorized access attempts using stale session tokens. Review Rancher version to confirm if it is >=v2.15.0 and <v2.15.2.

Useful 0 Not Useful 0

Impact Analysis

An attacker could gain unauthorized access to your Rancher account and perform actions with your permissions. This includes accessing sensitive data, modifying configurations, or performing administrative tasks if the session token has elevated privileges. The impact depends on the permissions associated with the compromised account.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating compliance requirements such as GDPR's data protection principles or HIPAA's access controls. Organizations using affected Rancher versions may face compliance violations if unauthorized access occurs, potentially resulting in legal or financial penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade Rancher to version 2.15.2 or later to apply the fix. As a temporary workaround, reduce session token time-to-live settings or manually delete active session tokens from the backing store. Ensure all authentication providers (OIDC-based) are updated and configured correctly.

Useful 0 Not Useful 0