Introduction
A single oversized API request can crash Rancher Manager, disrupting Kubernetes operations for entire organizations. CVE-2024-58259 exposes a critical flaw in how Rancher Manager handles incoming request bodies, allowing attackers to exhaust server memory and trigger a denial of service.
About Rancher Manager and SUSE: Rancher Manager, developed by SUSE, is a leading open-source platform for managing Kubernetes clusters at scale. It is widely adopted by enterprises to orchestrate containerized workloads across diverse environments. SUSE is a major force in the enterprise Linux and container management space, serving thousands of organizations globally and maintaining a strong security response track record.
Technical Information
CVE-2024-58259 is rooted in Rancher Manager's failure to enforce request body size limits on multiple API endpoints. Both unauthenticated endpoints (notably /v3-public/*) and several authenticated endpoints are affected. Attackers can exploit this by sending HTTP requests with extremely large payloads to these endpoints. The server processes the entire request body in memory before any validation or size check occurs. This allows a remote attacker to exhaust available memory, causing the Rancher Manager service to become unresponsive or crash.
Key technical points:
- The vulnerability exists due to missing request body size checks in the API handling logic.
- Both public (unauthenticated) and authenticated endpoints are affected, expanding the attack surface.
- Attackers do not need valid credentials to exploit some endpoints, increasing risk for internet-exposed instances.
- The flaw is classified under CWE-770 (Allocation of Resources Without Limits or Throttling).
- The patched versions introduce a hard limit of 1MB for request body size. Requests exceeding this threshold receive a 413 error and are rejected before consuming excessive memory.
No vulnerable code snippets have been made public in advisories or research at this time.
Patch Information
To address the vulnerability in Rancher Manager, the development team implemented a patch that enforces strict limits on the size of request bodies for both public and authenticated API endpoints. This measure prevents the server from processing excessively large payloads that could lead to memory exhaustion and potential denial of service.
The core of the patch involves setting a maximum allowable size for incoming request bodies. When a request exceeds this predefined limit, the server immediately terminates the connection, returning an appropriate error response to the client. This proactive approach ensures that the server's resources are protected from malicious or inadvertent overloads.
For example, in the updated code, the server configuration includes a parameter like:
const maxRequestBodySize = 1048576 // 1MB
This line sets the maximum request body size to 1 megabyte. During request processing, the server checks the size of each incoming request:
if r.ContentLength > maxRequestBodySize { http.Error(w, "Request entity too large", http.StatusRequestEntityTooLarge) return }
In this snippet, r.ContentLength represents the size of the incoming request. If it exceeds the maxRequestBodySize, the server responds with a 413 Request Entity Too Large status code and terminates the request.
By integrating these checks, the patch effectively mitigates the risk of denial of service attacks stemming from oversized request bodies. This enhancement is part of the following patched versions:
- 2.12.1
- 2.11.5
- 2.10.9
- 2.9.12
Users are strongly encouraged to upgrade to these versions to ensure their systems are protected against this vulnerability.
Patch source: https://github.com/rancher/rancher/security/advisories/GHSA-4h45-jpvh-6p5j
Detection Methods
Detecting exploitation attempts targeting the Log4j vulnerability (CVE-2021-44228) involves monitoring for specific patterns in logs and network traffic. (gist.github.com)
Log Analysis:
To identify potential exploitation attempts, search through your system logs for patterns indicative of the vulnerability. For instance, you can use the following command to scan uncompressed log files:
sudo egrep -I -i -r '\$(\{|%7B)jndi:(ldap[s]?|rmi|dns|nis|iiop|corba|nds|http):/[^\n]+' /var/log
This command recursively searches through the /var/log directory for strings that match the exploit pattern. (gist.github.com)
Network Traffic Monitoring:
Implementing intrusion detection system (IDS) rules can help in identifying malicious network activity associated with Log4j exploitation. Emerging Threats provides a set of signatures designed to detect such attempts. (github.com)
Automated Scanning Tools:
Utilize specialized tools to scan your environment for vulnerable instances of Log4j. For example, the log4j-detector tool analyzes .class files to determine the Log4j version and its vulnerability status. (gist.github.com)
By integrating these detection methods into your security monitoring processes, you can enhance your organization's ability to identify and respond to potential Log4j exploitation attempts effectively.
Detection sources:
- https://gist.github.com/Neo23x0/e4c8b03ff8cdf1fa63b7d15db6e3860b
- https://github.com/EmergingThreats/log4shell-detection
Affected Systems and Versions
- Rancher Manager versions prior to 2.12.1, 2.11.5, 2.10.9, and 2.9.12 are vulnerable.
- The vulnerability affects both public (unauthenticated) and authenticated API endpoints.
- Notably, endpoints under
/v3-public/*are vulnerable to unauthenticated exploitation. - All configurations exposing these endpoints are at risk, especially if accessible from untrusted networks or the internet.
Vendor Security History
SUSE has a history of prompt and transparent responses to security issues in Rancher Manager. Previous advisories document resource exhaustion and authentication vulnerabilities, with multi-version patch releases and detailed technical guidance. The vendor maintains a mature vulnerability disclosure and remediation process, with advisories published through multiple channels and coordinated with security databases.