-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability lies in Steve not verifying server certificates during TLS connections, specifically when fetching UI assets from a remote URL. The provided patches (e.g., 9dc48c7b361a927ce982895b8397bca5acd1baae) clearly show changes in pkg/ui/handler.go.
insecureClient was removed. This client was initialized with tls.Config{ InsecureSkipVerify: true }, which is the root cause of the vulnerability.serveIndex was modified to stop using this insecureClient. Instead, it now creates a new http.Client with default (secure) TLS settings for each call. This function directly performed the insecure GET request using the insecureClient.(u *Handler) IndexFile calls serveIndex when the UI path is determined to be a URL. This makes IndexFile a key part of the vulnerable execution path when remote UI fetching is enabled.Therefore, serveIndex is directly vulnerable as it performed the insecure network call, and (*Handler).IndexFile is vulnerable as it orchestrates the call to serveIndex with user-controlled or configuration-controlled URLs.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/rancher/steve | go | >= 0.2.0, < 0.2.1 | 0.2.1 |
| github.com/rancher/steve | go | >= 0.4.0, < 0.4.4 | 0.4.4 |
| github.com/rancher/steve | go | >= 0.5.0, < 0.5.13 | 0.5.13 |
| github.com/rancher/steve | go | >= 0.3.0, < 0.3.3 | 0.3.3 |