The Argo CD web terminal session does not handle the revocation of user permissions properly.

Summary

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD has a Web-based terminal that allows users to get a shell inside a running pod, just as they would with kubectl exec. Starting in version 2.6.0, when the administrator enables this function and grants permission to the user `p, role:myrole, exec, create, /, allow`, even if the user revokes this permission, the user can still perform operations in the container, as long as the user keeps the terminal view open for a long time. Although the token expiration and revocation of the user are fixed, however, the fix does not address the situation of revocation of only user `p, role:myrole, exec, create, /, allow` permissions, which may still lead to the leakage of sensitive information. A patch for this vulnerability has been released in Argo CD versions 2.11.7, 2.10.16, and 2.9.21.

Timeline

1. Jul 24, 2024, 5:16 PM UTCCVE published
2. Jul 24, 2024, 6:05 PM UTCCISA SSVC assessment

   Exploitation: poc · Automatable: no · Technical impact: partial

3. Aug 12, 2024, 9:02 PM UTCRecord last updated

Affected versions

• argoproj argo-cd

  From 2.6.0 · fixed in 2.9.21; From 2.10.0 · fixed in 2.10.16; From 2.11.0 · fixed in 2.11.7

• github.com/argoproj/argo-cdGo

  All versions

• github.com/argoproj/argo-cd/v2Go

  From 2.6.0 · fixed in 2.9.21; From 2.10.0 · fixed in 2.10.16; From 2.11.0 · fixed in 2.11.7

• github.com/argoproj/argo-cd/v2Go

  From 2.6.0 · fixed in 2.9.21

• github.com/argoproj/argo-cd/v2Go

  From 2.10.0 · fixed in 2.10.16

• github.com/argoproj/argo-cd/v2Go

  From 2.11.0 · fixed in 2.11.7

References 5