Argo CD vulnerable to Bypassing of Brute Force Protection via Application Crash and In-Memory Data Loss
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 2.8.13, 2.9.9, 2.10.4
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: poc
- Automatable: yes
- Technical impact: total
Summary
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to versions 2.8.13, 2.9.9, and 2.10.4, an attacker can exploit a chain of vulnerabilities, including a Denial of Service (DoS) flaw and in-memory data storage weakness, to effectively bypass the application's brute force login protection. This is a critical security vulnerability that allows attackers to bypass the brute force login protection mechanism. Not only can they crash the service affecting all users, but they can also make unlimited login attempts, increasing the risk of account compromise. Versions 2.8.13, 2.9.9, and 2.10.4 contain a patch for this issue.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: poc · Automatable: yes · Technical impact: total
- Record last updated
Affected versions
- argoproj argo-cd
fixed in 2.8.13; From 2.9.0 · fixed in 2.9.9; From 2.10.0 · fixed in 2.10.4
- github.com/argoproj/argo-cd/v2Go
fixed in 2.8.13
- github.com/argoproj/argo-cd/v2Go
From 2.9.0 · fixed in 2.9.9
- github.com/argoproj/argo-cd/v2Go
From 2.10.0 · fixed in 2.10.4
- github.com/argoproj/argo-cd/v2Go
fixed in 2.8.13; From 2.9.0 · fixed in 2.9.9; From 2.10.0 · fixed in 2.10.4