CVE-2021-25320

Executive Summary

CVE-2021-25320 is a critical improper access control vulnerability in Rancher, a widely deployed Kubernetes management platform. The flaw allows authenticated cluster users to make requests to cloud providers by submitting requests containing a cloud-credential ID, which the Rancher server processes by attaching the associated cloud credentials without performing additional authorization checks. This results in a privilege escalation scenario, as users without explicit access to cloud credentials can potentially leverage them to interact with cloud provider APIs, leading to unauthorized operations within connected cloud environments. The vulnerability impacts Rancher versions prior to 2.5.9 and versions prior to 2.4.16, carrying a critical CVSS score of 9.9 due to its network attack vector, low privilege requirement, and high impact on confidentiality, integrity, and availability.

Technical Analysis

The vulnerability is classified as an Improper Access Control issue (CWE-284). The underlying mechanism involves the Rancher proxy API, which is designed to mediate requests between authenticated cluster users and external cloud provider APIs. When a user submits a request referencing a cloud-credential ID, the Rancher server retrieves the associated credentials and forwards the request to the target cloud provider endpoint.

The core flaw resides in the authorization validation step — or rather, the absence of it. The Rancher server attaches the requested cloud credentials to the outgoing request without verifying that the requesting user has been granted permission to use those specific credentials. This contrasts with expected behavior, where Rancher would perform a permission check against the user's role bindings and project/cluster-level access controls before attaching any secrets.

From an architectural perspective, the proxy API functions as a trusted intermediary. It retains access to all configured cloud credentials because it needs to attach them to outbound requests for users who do have legitimate access. The vulnerability exploits this trust boundary: by manipulating the request parameters (the cloud-credential ID field), a malicious authenticated user can trick the proxy into attaching credentials that belong to a different user, project, or cluster.

Insufficient technical detail is available regarding the exact request format, endpoint paths, or parameter names involved. The NVD description mentions "creating requests with the cloud-credential ID" as the triggering mechanism, but does not disclose specific URI structures or API parameter names. The attack surface is the Rancher management plane, which is typically exposed via a web interface (default port 443/8443) and is commonly reachable from the corporate network or, in some misconfigurations, the public internet.

The severity is compounded by the scope of credential access within Rancher deployments. A single Rancher installation often manages multiple clusters across multiple cloud providers (AWS, GCP, Azure). All cloud credentials configured in Rancher's node driver or cloud provider settings are potential targets for unauthorized use through this proxy API bypass. Successful exploitation could allow an attacker to provision, terminate, or manipulate cloud resources — depending on the scope of the attached credentials' IAM permissions in the target cloud account.

Exploitation Scenarios

1) Reconnaissance / Target Identification: An attacker with low-privilege access to a Rancher-managed Kubernetes cluster first enumerates the available cloud credential IDs. This can be achieved through the Rancher UI or API by enumerating resources related to node templates, cloud credentials, or by observing configuration values. The attacker requires authenticated access but not elevated privileges — the vulnerability specifically enables privilege escalation from a standard cluster member role.

2) Triggering the Flaw: The attack is executed by crafting a request to the Rancher proxy API that includes a cloud-credential ID to which the attacker has no explicit access. Because the vulnerability class is improper access control (specifically, a missing authorization check), the attacker's request is processed and forwarded to the target cloud provider's API. The Rancher server attaches the credentials associated with the referenced cloud-credential ID, making the request appear authentic to the cloud provider.

3) Payload / Execution at Vulnerability-Class Level: The attack does not require a malicious payload in the traditional sense. Rather, the exploitation leverages the victim's own credentials — the cloud provider access keys stored in Rancher — to make authorized-looking API calls to cloud services. The attacker effectively repurposes the Rancher server as a proxy for unauthorized cloud API operations. In practice, the attacker would issue read and write requests to cloud endpoints (e.g., listing, creating, modifying, or deleting cloud resources) using the stolen credential context. The precise cloud API endpoints vary by provider (AWS EC2, GCP Compute, Azure VMs, etc.) and depend on the scope of the attached credentials.

4) Post-Exploitation Impact: After successful exploitation, the attacker can perform any operation allowed by the attached cloud credentials' IAM permissions. Common post-exploitation actions include data exfiltration from cloud storage buckets, resource hijacking for cryptomining, credential harvesting from metadata services, or infrastructure disruption by terminating compute instances. In severe cases, lateral movement into the cloud provider account could allow the attacker to pivot to other connected systems.

No public PoC is available; attack chain is inferred from vulnerability class. The fact that the CVE-title specifically references "users without access" being able to use credentials "through proxy API" confirms a server-side authorization bypass rather than a client-side validation issue.

Impact Assessment

Business Impact: The CVSS score of 9.9 places this vulnerability in the critical severity bin. The vector indicates: Network (AV:N) attack vector, Low (AV:L) privilege required, No user interaction (UI:N), and a Changed scope (S:C). The impact metrics for confidentiality, integrity, and availability are all High (C:H/I:H/A:H).

The changed scope is particularly significant — it means the vulnerability impacts resources beyond the Rancher management plane itself. Compromised cloud credentials expose the entire connected cloud infrastructure, potentially affecting production workloads, storage, databases, and networking resources across multiple cloud accounts.

Affected Systems: Rancher versions prior to 2.5.9 and prior to 2.4.16. These are independently maintained release branches; organizations running either series must ensure they are on at least the specified patched version.

Blast Radius: The blast radius extends beyond the immediate Rancher cluster. Because Rancher is a multi-cluster management platform, a single compromised installation could grant unauthorized access to all cloud providers connected to that Rancher instance. The EPSS score of 0.00855 places this at a moderate exploitation likelihood percentile (54.9%), suggesting that while exploitation is not currently widespread, it is established enough to warrant priority patching. The low privilege requirement and the potential for cloud account takeover make this a high-value target for attackers with any level of authenticated access.

Detection Guidance

The following detection rules are generated based on the vulnerability class and attack mechanism. They focus on detecting attempts to leverage cloud credentials via proxy access and anomalous access patterns to Rancher's API.

Sigma Rule

title: Rancher Cloud Credential Proxy API Access
id: 5e1f8a3b-9c2d-4a9e-8b4f-2c1d7e9f4a6b
status: experimental
description: Detects attempts by Rancher users to access cloud credentials through the proxy API without proper authorization, potentially indicating exploitation of CVE-2021-25320.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2021-25320
author: Valtersit Threat Intelligence
logsource:
  category: application
  product: rancher
  service: rancher-api
detection:
  selection_cloud_credential:
    cs4:
      cs4.uri.query|contains|all:
        - 'cloud-credential'
        - 'proxy'
  selection_node_template:
    cs4.uri.query|contains: 'nodetemplate'
  keyword_credential_id:
    cs4.uri.query|contains|all:
      - 'credentialId'
      - 'id='
  selection_low_privilege:
    cs4.user_role: ['member', 'user']
  condition: (selection_cloud_credential or selection_node_template) and selection_low_privilege
  timeframe: 5m
falsepositives:
  - Legitimate credentialed access by users with appropriate permissions
  - Rancher admin operations performing credential lifecycle management
level: medium
tags:
  - attack.t1190
  - cve.2021.25320
  - impact.credential_access
  - impact.lateral_movement

YARA Rule

rule rancher_cve_2021_25320_credential_bypass {
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects network traffic or logs containing patterns of unauthorized cloud credential usage via Rancher proxy API"
        cve = "CVE-2021-25320"
        severity = "critical"
        date = "2025-01-10"
    strings:
        $s1 = "cloud-credential" ascii nocase
        $s2 = "proxy" ascii nocase
        $s3 = "credentialId" ascii nocase
        $s4 = "cloud-credential-id" ascii nocase
        $s5 = "nodeTemplate" ascii nocase
        $s6 = "rancher" ascii nocase
    condition:
        uint16(0) == 0x5B7B and  // JSON opening
        any of ($s*) and
        (#s1 >= 1) and
        (#s2 >= 1) and
        (#s3 >= 1)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2021-25320 Rancher Cloud Credential Proxy Access Attempt"; flow:to_server,established; content:"cloud-credential"; nocase; http_uri; content:"proxy"; nocase; http_uri; content:"credentialId"; nocase; http_uri; reference:cve,2021-25320; classtype:attempted-user; sid:20250001; rev:1; metadata:created_at 2025_01_10, updated_at 2025_01_10, cve CVE_2021_25320;)

Elastic Detection

sequence by process.entity_id
  with maxspan=5m
  [ any where process.name == "rancher" and
    process.args.* contains "credentialId" and
    process.args.* contains "cloud-credential" ]
  [ network where true and
    destination.port in (443, 8443) and
    process.name == "rancher" and
    network.protocol == "http" and
    url.path contains "proxy" ]

Splunk SPL Query

index=proxy sourcetype=rancher:api
| search "/cloud-credential" OR "cloud-credential-id"
| search "/proxy" OR "proxy=true"
| search "credentialId=*"
| eval user_privilege=case(user_role=="admin", "high",
                           user_role=="cluster-owner", "high",
                           user_role=="project-member", "medium",
                           user_role=="member", "low",
                           true, "unknown")
| where user_privilege=="low" OR user_privilege=="medium"
| table _time, src_host, user, user_privilege, uri, http_method, status
| sort - _time
| head 100

Wazuh OSSEC Rule

<group name="rancher,">
  <rule id="100211" level="12">
    <decoded_as>json</decoded_as>
    <field name="uri">\.*cloud-credential\.*</field>
    <field name="uri">\.*proxy\.*</field>
    <field name="uri">\.*credentialId\.*</field>
    <description>Rancher: Potential CVE-2021-25320 exploitation attempt - cloud credential access via proxy API</description>
    <group>rancher, cloud-credential-bypass, CVE-2021-25320,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
  <rule id="100212" level="10">
    <decoded_as>json</decoded_as>
    <field name="user_role">member|user</field>
    <field name="uri">\.*cloud-credential\.*</field>
    <field name="uri">\.*proxy\.*</field>
    <description>Rancher: Low-privilege user accessing cloud credential proxy endpoint</description>
    <group>rancher, cloud-credential-bypass,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No patch evidence is available from tracked sources. The NVD description references versions 2.5.9 and 2.4.16 as containing fixes, but no vendor advisory or patch notes were identified in the provided intelligence data. Exercise caution — upgrading to these versions is recommended but cannot be confirmed as fully resolving the issue.

1) Immediate Mitigations:

• Restrict network access to the Rancher management plane. Ensure the Rancher UI/API is not publicly exposed and is only reachable from trusted networks via VPN or bastion hosts.
• Limit the number of users with any authenticated access to the Rancher platform. Review current user lists and disable accounts for users who no longer require access.
• Monitor Rancher audit logs for anomalous API requests containing cloud-credential references, especially from low-privilege users.
• If possible, temporarily disable the node driver / cloud provider components that use the affected proxy functionality until patching can be performed.

2) Patch / Upgrade Steps:

• The NVD description indicates that Rancher versions 2.5.9 and 2.4.16 address this issue. Upgrade to these versions or later releases in the respective branches.
• Verify the upgrade in a staging environment first, ensuring that cloud credential provisioning and node driver operations still function correctly.
• After upgrade, audit and reconfigure cloud credential access controls to ensure least-privilege principles are applied across all Rancher projects and clusters.

3) Long-Term Hardening:

• Implement role-based access control (RBAC) policies within Rancher that restrict cloud-credential usage to specific users, projects, and clusters. Use custom role templates if standard roles are insufficiently granular.
• Rotate all cloud provider credentials that were stored in Rancher at any point, since these credentials may have been exposed during the period the vulnerability was present.
• Enable comprehensive audit logging on both Rancher and connected cloud providers. Configure alerting for any API calls originating from the Rancher instance that appear anomalous.
• Track vendor advisories for CVE-2021-25320 to confirm that the version you deployed fully addresses the vulnerability, and apply subsequent security updates promptly.
• Implement network segmentation so that the Rancher management plane cannot directly reach cloud provider APIs except through sanctioned proxying channels that enforce additional authorization checks.

References

1. NIST NVD: https://nvd.nist.gov/vuln/detail/CVE-2021-25320 — Official NVD entry containing the vulnerability description and CVSS score.

2. CNA Title Reference: "Rancher: Cloud credentials can be used through proxy API by users without access" — Description of the vulnerability as reported in the CVE record.

3. CISA Known Exploited Vulnerabilities Catalog: NOT LISTED (as of the intelligence data date). This CVE has not been confirmed as exploited in the wild by CISA at the time of writing.

4. EPSS Data: EPSS score of 0.00855 (54.9% percentile) — indicates moderate exploitation probability; monitoring recommended.

5. Valtersit Threat Intelligence Note: No public exploit code or Nuclei template has been identified for this CVE at the time of analysis. Attack chain is inferred from vulnerability class. Monitor Rancher security advisories for further patch confirmation.