Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 2.14.20, 3.2.0-rc2, 3.1.8, 3.0.19
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: poc
- Automatable: yes
- Technical impact: partial
Summary
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Versions 1.2.0 through 1.8.7, 2.0.0-rc1 through 2.14.19, 3.0.0-rc1 through 3.2.0-rc1, 3.1.7 and 3.0.18 are vulnerable to malicious API requests which can crash the API server and cause denial of service to legitimate clients. Without a configured webhook.bitbucketserver.secret, Argo CD's /api/webhook endpoint crashes when receiving a malformed Bitbucket Server payload (non-array repository.links.clone field). A single unauthenticated request triggers CrashLoopBackOff, and targeting all replicas causes complete API outage. This issue is fixed in versions 2.14.20, 3.2.0-rc2, 3.1.8 and 3.0.19.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: poc · Automatable: yes · Technical impact: partial
- Record last updated
Affected versions
- argoproj argo-cd
From 1.2.0 · through 1.8.7; From 2.0.0-rc1 · fixed in 2.14.20; From 3.2.0-rc1 · fixed in 3.2.0-rc2; From 3.1.0-rc1 · fixed in 3.1.8; From 3.0.0-rc1 · fixed in 3.0.19
- github.com/argoproj/argo-cdGo
From 1.2.0 · through 1.8.7
- github.com/argoproj/argo-cd/v2Go
From 2.0.0-rc1 · fixed in 2.14.20
- github.com/argoproj/argo-cd/v3Go
From 3.2.0-rc1 · fixed in 3.2.0-rc2
- github.com/argoproj/argo-cd/v3Go
From 3.1.0-rc1 · fixed in 3.1.8
- github.com/argoproj/argo-cd/v3Go
From 3.0.0-rc1 · fixed in 3.0.19
- github.com/argoproj/argo-cdGo
From 1.2.0
- github.com/argoproj/argo-cd/v2Go
fixed in 2.14.20
- github.com/argoproj/argo-cd/v3Go
From 3.0.0-rc1 · fixed in 3.0.19; From 3.1.0-rc1 · fixed in 3.1.8; From 3.2.0-rc1 · fixed in 3.2.0-rc2