CVE-2023-32192

Rancher API Server Cross-site Scripting Vulnerability

Workarounds

There is no direct mitigation besides updating API Server to a patched version.

References

If you have any questions or comments about this advisory:

• Reach out to the SUSE Rancher Security team for security-related inquiries.
• Open an issue in the Rancher repository.
• Verify with our support matrix and product support lifecycle.

A vulnerability has been identified in which unauthenticated cross-site scripting (XSS) in the API Server's public API endpoint can be exploited. This can lead to an attacker exploiting the vulnerability to trigger JavaScript code and execute commands remotely.

The attack vector was identified as a Reflected XSS.

API Server propagates malicious payloads from user input to the UI, which renders the output. For example, a malicious URL gets rendered into a script that is executed on a page.

The changes addressed by this fix are:

• Encode input that comes from the request URL before adding it to the response.
• The request input is escaped by changing the URL construction that is used for links to use url.URL.
• The request input is escaped by escaping the JavaScript and CSS variables with attribute encoding as defined by OWASP.

CVE-2023-32192 has a CVSS score of 8.3 (High). The vector is network-reachable, no privileges required, and user interaction required. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (0.0.0-20240207153957-4fd7d821d952); upgrading removes the vulnerable code path.

Kodem intelligence

Already deployed Kodem?

Patched versions include the following commits:

1. What is CVE-2023-32192? CVE-2023-32192 is a high-severity security vulnerability in github.com/rancher/apiserver (go), affecting versions < 0.0.0-20240207153957-4fd7d821d952. It is fixed in 0.0.0-20240207153957-4fd7d821d952.
2. How severe is CVE-2023-32192? CVE-2023-32192 has a CVSS score of 8.3 (High). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
3. Which versions of github.com/rancher/apiserver are affected by CVE-2023-32192? github.com/rancher/apiserver (go) versions < 0.0.0-20240207153957-4fd7d821d952 is affected.
4. Is there a fix for CVE-2023-32192? Yes. CVE-2023-32192 is fixed in 0.0.0-20240207153957-4fd7d821d952. Upgrade to this version or later.
5. Is CVE-2023-32192 exploitable, and should I be worried? Whether CVE-2023-32192 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
6. What actually determines whether CVE-2023-32192 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
7. How do I fix CVE-2023-32192? Upgrade github.com/rancher/apiserver to 0.0.0-20240207153957-4fd7d821d952 or later.