CVE-2021-31999

Executive Summary

CVE-2021-31999 is a privilege escalation vulnerability in Rancher, the open-source Kubernetes management platform, that allows any authenticated user within a managed cluster to impersonate other users or groups by manipulating Impersonate-User and Impersonate-Group HTTP headers. Rancher versions prior to 2.5.9 and 2.4.16 are affected. Successful exploitation grants an attacker the security context, permissions, and access rights of arbitrary identities — including potentially cluster administrators — represent a critical integrity and confidentiality risk to enterprises running multi-tenant Kubernetes workloads on affected Rancher versions. The vulnerability carries a CVSS score of 8.8 (High), and while no public exploit or CISA KEV inclusion has been recorded, the severity and accessibility of the attack surface make this a priority candidate for immediate remediation.

Technical Analysis

The vulnerability class for this CVE is CWE-807: Reliance on Untrusted Inputs in a Security Decision. The NVD description states that users in the cluster can act as other users in the cluster by forging the Impersonate-User or Impersonate-Group headers. This is a classic authorization bypass mechanism where a security decision (who is this request coming from) is made based on client-supplied HTTP headers rather than an authenticated session token, server-side identity store, or a validated certificate.

Affected component: Rancher's Kubernetes API proxy / authentication layer. Rancher acts as an authentication proxy between end-users and the Kubernetes API server. In this design, Rancher authenticates a user, then relays their request to the Kubernetes API server, setting impersonation headers to define the effective identity for that request.

Vulnerable logic: When a user makes an API call through Rancher, Rancher forwards it to the Kubernetes API server. If Rancher fails to overwrite or sanitize client-supplied Impersonate-User and Impersonate-Group HTTP headers before forwarding the request, the Kubernetes API server trusts these headers and assumes the requesting principal is the fabricated identity.

Attack surface: The affected interface is the Rancher management API surface exposed to authenticated cluster users. Any user with valid credentials to a Rancher-managed Kubernetes cluster (even with minimal RBAC permissions) can send crafted API requests containing spoofed impersonation headers.

Exploitation precondition: Authenticated access to a Rancher-managed cluster. No prior privilege escalation is required.

Root cause: Insufficient validation/sanitization of connection headers by Rancher when relaying requests to the underlying Kubernetes API server, combined with Kubernetes' native support for user impersonation via these headers (a legitimate feature intended for administrators).

Affected versions: All Rancher versions prior to 2.5.9 and prior to 2.4.16. Version 2.5.9 and 2.4.16 are the first patched releases.

Insufficient technical detail is available regarding the exact code path or function responsible for header validation. No specific endpoint names or code-level identifiers are provided in the official description.

Exploitation Scenarios

No public PoC or exploit code is available; the attack chain is inferred from the vulnerability class and the NVD description.

Step 1 — Reconnaissance / Target Identification An attacker enumerates Rancher-managed Kubernetes clusters accessible via HTTP(S). Rancher's web UI and management API are commonly exposed on ports 443/80. The attacker authenticates as a legitimate low-privileged user (e.g., a developer with access to a development namespace).

Step 2 — Triggering the Flaw The attacker makes an authenticated API request to a Rancher management endpoint. The request includes crafted HTTP headers:

• Impersonate-User: <target-username> (e.g., cluster-admin or system:masters)
• Impersonate-Group: <target-group> (e.g., system:masters or system:cluster-admins)

Since Rancher does not strip or overwrite these headers before forwarding the request to the Kubernetes API server, the server treats the impersonation headers as authoritative and executes the request under the fabricated identity.

Step 3 — Payload / Execution The attacker sends a sequence of Kubernetes API requests leveraging the impersonated identity. Example actions at the vulnerability-class level: listing secrets across namespaces, reading cluster-admin configuration, creating privileged pods, or modifying RBAC bindings. The attacker can execute arbitrary administrative operations within the cluster without legitimate authorization.

Step 4 — Post-Exploitation Impact Successful impersonation allows the attacker to:

• Read sensitive secrets (tokens, credentials, database passwords) stored in Kubernetes secrets
• Deploy malicious workloads (cryptominers, backdoors, data exfiltration agents)
• Create persistent backdoors by modifying cluster roles and bindings
• Pivot to adjacent cloud infrastructure via service account tokens

In multi-tenant Rancher deployments, a cluster user can escalate to full cluster-admin and potentially affect other tenant workloads, making the blast radius multi-tenant.

Impact Assessment

CVSS Score: 8.8 (High). The vector is network-based (AV:N) with low attack complexity (AC:L), requires low privileges (PR:L), no user interaction (UI:N), and has a high confidentiality, integrity, and availability impact (C:H/I:H/A:H).

Business Impact:

• Confidentiality (High): Unauthorized access to secrets, credentials, and configuration data across the cluster.
• Integrity (High): Ability to alter workloads, RBAC policies, or deploy malicious containers.
• Availability (High): Potential for destructive actions — deleting namespaces, denial-of-service of critical workloads.

Affected Systems: Rancher-managed Kubernetes clusters running Rancher management server versions prior to 2.5.9 and 2.4.16. Downstream (managed) clusters are the primary at-risk environment.

Blast Radius: In multi-tenant environments, a single compromised user account can escalate to cluster-admin and affect all tenants and workloads running on the cluster. Lateral movement to the Kubernetes host layer or connected cloud infrastructure is possible through service account tokens and pod network access.

EPSS: 0.01052 (61.1% percentile) — low current weaponization probability, but non-zero.

CISA KEV: Not listed — no confirmed exploitation in the wild as of analysis date.

Detection Guidance

The following signatures target HTTP-level anomalies associated with exploitation attempts.

Sigma Rule

title: Rancher Kubernetes Impersonation Header Abuse
id: fc1a82b4-9e6e-4a90-9f38-5d92b1e34a7c
status: experimental
description: >-
  Detects HTTP requests to Rancher management endpoints that include
  Impersonate-User or Impersonate-Group headers, which may indicate
  an attempt to exploit CVE-2021-31999.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2021-31999
author: Valtersit Threat Intelligence
date: 2024/01/01
logsource:
  category: webserver
  product: rancher
  service: http
detection:
  selection_main:
    cs-method:
      - 'GET'
      - 'POST'
      - 'PUT'
      - 'PATCH'
      - 'DELETE'
    cs-uri-query|contains:
      - 'v3/projects'
      - 'v3/clusters'
      - 'apis/'
    cs-headers|contains:
      - 'Impersonate-User'
      - 'Impersonate-Group'
  selection_kubernetes:
    cs-uri-query|contains:
      - '/api/v1'
      - '/apis/'
  condition: selection_main and selection_kubernetes
  timeframe: 5m
fields:
  - clientip
  - cs-username
  - cs-uri-query
falsepositives:
  - Legitimate use by Rancher administrators using impersonation for debugging
  - Legitimate use by Kubernetes dashboard impersonation features
level: high
tags:
  - attack.t1190
  - cve.2021-31999

YARA Rule

rule Rancher_Impersonation_Header_Exploit_CVE_2021_31999
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects HTTP payloads attempting to exploit Rancher impersonation header bypass"
        cve = "CVE-2021-31999"
        severity = "high"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2021-31999"
        date = "2024-01-01"

    strings:
        $h1 = "Impersonate-User" ascii nocase
        $h2 = "Impersonate-Group" ascii nocase
        $h3 = "Impersonate-Extra" ascii nocase
        $p1 = "v3/projects" ascii nocase
        $p2 = "v3/clusters" ascii nocase
        $p3 = "apis/" ascii nocase
        $p4 = "api/v1" ascii nocase

    condition:
        uint16(0) == 0x0a0d and // HTTP header block
        ($h1 or $h2 or $h3) and
        any of ($p*)
}

Suricata IDS Rule

alert http any any -> $RANCHER_SERVERS 443 (msg:"ET EXPLOIT Rancher CVE-2021-31999 Impersonation Header Bypass Attempt"; flow:to_server,established; http.header_names; content:"Impersonate-User"; http.header_names; content:"Impersonate-Group"; http.method; content:"GET|POST|PUT|PATCH"; http.uri; content:"v3/projects|v3/clusters|apis/"; classtype:attempted-admin; reference:cve,2021-31999; sid:202131999001; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [network where event.category == "http" and http.request.method in ("GET", "POST", "PUT", "PATCH") and
   http.request.headers contains "Impersonate-User" and
   http.request.headers contains "Impersonate-Group"]
  [network where event.category == "http" and
   http.request.uri like "*v3/projects*" or http.request.uri like "*v3/clusters*" or http.request.uri like "*apis/*"]

Splunk SPL Query

index=web sourcetype=access_combined
| rex field=_raw "Impersonate-(User|Group):\s*[^\r\n]+"
| where isnotnull(Impersonate_Header)
| search uri="*v3/projects*" OR uri="*v3/clusters*" OR uri="*apis/*"
| eval severity=case(
    match(uri, "secrets|roles|bindings"), "high",
    match(uri, "pods|deployments"), "medium",
    true, "low"
  )
| table _time, src_ip, user, uri, Impersonate_Header, severity
| sort -_time
| stats count by severity, src_ip, user

Wazuh OSSEC Rule

<rule id="100319" level="12">
  <if_sid>31150</if_sid>
  <match>Impersonate-User</match>
  <description>Rancher CVE-2021-31999 — Impersonate-User header detected in HTTP request</description>
  <group>web_application_attack,rancher_cve_2021_31999,</group>
  <mitre>
    <id>T1190</id>
  </mitre>
  <info type="cve">CVE-2021-31999</info>
</rule>

<rule id="100320" level="12">
  <if_sid>100319</if_sid>
  <match>Impersonate-Group</match>
  <description>Rancher CVE-2021-31999 — Impersonate-Group header paired with Impersonate-User; likely exploitation attempt</description>
  <group>web_application_attack,rancher_cve_2021_31999,</group>
  <mitre>
    <id>T1190</id>
  </mitre>
</rule>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No patch evidence from any tracked source is available. No vendor fix has been published at the time of analysis, and no workarounds have been officially documented.

1) Immediate Mitigations (if upgrade is not possible)

• Restrict network access: Limit access to the Rancher management API to trusted IP ranges or VPN-only access.
• Harden RBAC: Review and minimize the number of users with any cluster access; disable unused accounts.
• Enable audit logging: Ensure Kubernetes audit logging is enabled and retained; monitor for anomalous impersonation events.
• Deploy WAF rules: Configure a web application firewall to strip Impersonate-* headers from inbound requests to Rancher endpoints.
• Input validation: If a reverse proxy is in front of Rancher, modify its configuration to remove or overwrite Impersonate-User and Impersonate-Group headers before forwarding requests to the Rancher server.

2) Patch / Upgrade Steps

• Upgrade Rancher to version 2.5.9 or later or 2.4.16 or later as soon as a CVE-mitigating release is confirmed available.
• Before upgrading in production, test in a staging environment that replicates production cluster topology.
• Validate that all downstream clusters are compatible with the upgraded Rancher version; review the Rancher release notes for migration prerequisites.
• After upgrade, verify that impersonation headers are properly sanitized by attempting a test request containing spoofed Impersonate-User headers from a low-privileged account and confirming it fails.

3) Long-Term Hardening

• Principle of Least Privilege: Ensure users have minimum necessary cluster access; avoid granting cluster-admin unless absolutely required.
• Multi-factor authentication: Require MFA for all Rancher users, especially those with elevated privileges.
• Network segmentation: Isolate the Rancher management plane from the public internet; place it behind a bastion/proxy.
• Regular vulnerability scanning: Include Rancher in the enterprise vulnerability management program; track CVEs with EPSS scores to prioritize remediation.
• Monitor advisory channels: Subscribe to Rancher's security advisories and GitHub release notification to receive patch announcements as soon as they are published.
• Incident response preparation: Develop a runbook for Kubernetes impersonation attacks, including steps for forensic collection of audit logs and revoking impersonation-related permissions.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2021-31999
2. Rancher Security Advisory (Official): https://github.com/rancher/rancher/security/advisories — Verify for CVE-2021-31999-specific advisory.
3. Rancher Release Notes: https://github.com/rancher/rancher/releases — Rancher 2.5.9 and 2.4.16 release notes.
4. MITRE ATT&CK Technique: https://attack.mitre.org/techniques/T1190/ — Exploit Public-Facing Application.
5. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — CVE-2021-31999 not listed (as of analysis date).

Exploit-in-the-Wild Evidence: No confirmed exploitation in the wild has been publicly documented. EPSS score of 0.01052 (61.1% percentile) indicates low current exploit probability, but the low bar for exploitation (authenticated low-privileged user, network access to Rancher UI/API) makes this a high-watch item in environments where Rancher is internet-facing.