Miggo Logo
Miggo Vulnerability Database
→
CVE-2022-43757

CVE-2022-43757:
Plaintext storage of sensitive data in Rancher API and cluster.management.cattle.io objects

8.8

CVSS Score
3.1

Basic Information

CVE ID
CVE-2022-43757
GHSA ID
GHSA-cq4p-vp5q-4522
EPSS Score
0.24102%
CWE
CWE-200
Published
1/25/2023
Updated
2/15/2023
KEV Status
No
Technology
TechnologyGo

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
github.com/rancher/ranchergo>= 2.5.0, < 2.5.172.5.17
github.com/rancher/ranchergo>= 2.6.0, < 2.6.102.6.10
github.com/rancher/ranchergo>= 2.7.0, < 2.7.12.7.1

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from sensitive fields being stored in plaintext within Kubernetes objects (e.g., Clusters) due to insufficient data handling in Rancher's code. While the advisory lists specific struct fields (e.g., Cluster.Spec.RancherKubernetesEngineConfig.Services.KubeAPI.SecretsEncryptionConfig.CustomConfig.Providers[].AESGCM.Keys[].Secret), the exact functions responsible for serializing/storing these fields are not explicitly named in the provided data. The root cause likely involves functions that process and persist Cluster objects without redacting sensitive data or migrating it to Secrets. However, without access to the specific commit diffs, GitHub patches, or Rancher's internal code structure, identifying the precise vulnerable functions (e.g., specific controller methods or API handlers) with high confidence is not possible. The advisory focuses on struct-level fields rather than functions, making function-level attribution speculative.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t T*is issu* *****ts R*n***r v*rsions *rom *.*.* up to *n* in*lu*in* *.*.**, *rom *.*.* up to *n* in*lu*in* *.*.* *n* *.*.*. It w*s *is*ov*r** t**t t** s**urity **visory *V*-****-***** (**S*-**j*-**q*-*w**), pr*viously r*l**s** *y R*n***r,

Reasoning

T** vuln*r**ility st*ms *rom s*nsitiv* *i*l*s **in* stor** in pl*int*xt wit*in Ku**rn*t*s o*j**ts (*.*., *lust*rs) *u* to insu**i*i*nt **t* **n*lin* in R*n***r's *o**. W*il* t** **visory lists sp**i*i* stru*t *i*l*s (*.*., *lust*r.Sp**.R*n***rKu**rn*