8.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2024-58259

CVE-2024-58259: Rancher affected by unauthenticated Denial of Service

Impact

A vulnerability has been identified within Rancher Manager in which it did not enforce request body size limits on certain public (unauthenticated) and authenticated API endpoints. This allows a malicious user to exploit this by sending excessively large payloads, which are fully loaded into memory during processing. This could result in:

Denial of Service (DoS): The server process may crash or become unresponsive when memory consumption exceeds available resources.
Unauthenticated and authenticated exploitation: While the issue was initially observed in unauthenticated /v3-public/* endpoints, the absence of request body size limits also affected several authenticated APIs, broadening the potential attack surface. It's worth noting that other areas in Rancher do implement safeguards: requests proxied to Kubernetes APIs are subject to built-in size limits enforced by the Kubernetes API server itself, and Norman-based endpoints parse input with predefined size caps. However, the absence of similar protections in other Rancher APIs increased the risk of denial-of-service (DoS) scenarios in certain contexts.

By sending large binary or text payloads to vulnerable endpoints, a malicious actor could disrupt Rancher’s availability, impacting both administrative and user operations across managed clusters.

Please consult the associated MITRE ATT&CK - Technique - Network Denial of Service for further information about this category of attack.

Patches

This vulnerability is addressed by adding a default limit of 1MiB and a setting in case this value needs to be increased.

Patched versions of Rancher include releases v2.12.1, v2.11.5, v2.10.9 and v2.9.12.

Workarounds

If you can't upgrade to a fixed version, please make sure that you are manually setting the request body size limits. For example, using nginx-ingress controller and only allowing requests via the ingress. For reference on how to configure the limit manually, please consult the Knowledge Base.

References

If you have any questions or comments about this advisory:

Reach out to the SUSE Rancher Security team for security related inquiries.
Open an issue in the Rancher repository.
Verify with our support matrix and product support lifecycle.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2024-58259

CVE-2024-58259:

8.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/rancher/rancher	go	>= 2.12.0, < 2.12.1	2.12.1
github.com/rancher/rancher	go	>= 2.11.0, < 2.11.5	2.11.5
github.com/rancher/rancher	go	>= 2.10.0, < 2.10.9	2.10.9
github.com/rancher/rancher	go	>= 2.9.0, < 2.9.11	2.9.11
github.com/rancher/rancher	go	< 0.0.0-20250813072957-aee95d4e2a41	0.0.0-20250813072957-aee95d4e2a41

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, CVE-2024-58259, is a denial-of-service weakness in Rancher Manager caused by the absence of request body size limits on several API endpoints. This allows an attacker to exhaust server memory by sending excessively large HTTP requests.

The analysis of the provided patch, commit aee95d4e2a41ba2df6f88c9634d4fe1f42dee4d9, reveals that the vulnerability is one of omission, where a crucial security control was missing. The fix involves introducing a new middleware, APIBodyLimitingHandler, which uses the standard library's http.MaxBytesHandler to enforce these limits.

The vulnerable functions identified are the ones responsible for setting up the HTTP routing and handlers without this protection. While these functions do not process the malicious input directly (that's done by the actual endpoint handlers like publicAPI and managementAPI), they are the source of the insecure configuration. During exploitation on a vulnerable version, the server would attempt to read the entire malicious payload into memory within the context of the handler for the targeted endpoint.

The two primary functions modified by the patch are:

github.com/rancher/rancher/pkg/auth.newAPIManagement: This function configures authentication-related endpoints, including /v3-public and /v1-saml. The patch applies the new size-limiting middleware to these routes.
github.com/rancher/rancher/pkg/multiclustermanager.router: This function sets up a wide range of unauthenticated endpoints. The patch wraps the entire router for these endpoints with the size-limiting middleware.

By identifying these two functions, we pinpoint the exact locations in the code where the insecure configuration originated. A security engineer can use this information to understand that any endpoint configured within these functions was likely vulnerable before the patch was applied.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

8.2

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2024-58259: Rancher affected by unauthenticated Denial of Service

Impact

Patches

Workarounds

References

CVE-2024-58259:

8.2

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

8.2

8.2

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Basic Information

Basic Information

CVE-2024-58259: Rancher affected by unauthenticated Denial of Service

Impact

Patches

Workarounds

References

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI