Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/rancher/steve | go | >= 0.2.0, < 0.2.1 | 0.2.1 |
| github.com/rancher/steve | go | >= 0.4.0, < 0.4.4 | 0.4.4 |
| github.com/rancher/steve | go | >= 0.5.0, < 0.5.13 | 0.5.13 |
| github.com/rancher/steve | go | >= 0.3.0, < 0.3.3 | 0.3.3 |
Miggo AIRoot Cause AnalysisThe vulnerability lies in Steve not verifying server certificates during TLS connections, specifically when fetching UI assets from a remote URL. The provided patches (e.g., 9dc48c7b361a927ce982895b8397bca5acd1baae) clearly show changes in pkg/ui/handler.go.
insecureClient was removed. This client was initialized with tls.Config{ InsecureSkipVerify: true }, which is the root cause of the vulnerability.serveIndex was modified to stop using this insecureClient. Instead, it now creates a new http.Client with default (secure) TLS settings for each call. This function directly performed the insecure GET request using the insecureClient.(u *Handler) IndexFile calls serveIndex when the UI path is determined to be a URL. This makes IndexFile a key part of the vulnerable execution path when remote UI fetching is enabled.Therefore, serveIndex is directly vulnerable as it performed the insecure network call, and (*Handler).IndexFile is vulnerable as it orchestrates the call to serveIndex with user-controlled or configuration-controlled URLs.
github.com/rancher/steve/pkg/ui.serveIndexpkg/ui/handler.go
github.com/rancher/steve/pkg/ui.(*Handler).IndexFilepkg/ui/handler.go