Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 3.3.15, 3.4.10, 3.5.4, 3.6.0-rc2
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: total
Summary
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.10.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, Argo CD creates PostDelete resource hooks without applying the AppProject destination and resource authorization checks used during ordinary synchronization. The omitted checks include cluster-scoped and namespaced resource allow/deny lists. A user who can write to an Application's Git repository can commit a delete hook targeting a forbidden namespace, server, group, kind, or resource name, and deletion of the Application causes the application-controller to create that resource with its destination-cluster credentials. The reachable impact is bounded by the controller's cluster access but can include cluster-scoped resources, disallowed namespaces, persistent hook objects, and secondary objects created by a hook Job. PreSync, Sync, PostSync, and SyncFail hooks continue to use the normal project checks. This issue is fixed in versions 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: total
- Record last updated
Affected versions
- argoproj argo-cd
From 2.10.0 · through 2.14.21; From 3.0.0 · fixed in 3.3.15; From 3.4.0 · fixed in 3.4.10; From 3.5.0 · fixed in 3.5.4; From 3.6.0-rc1 · fixed in 3.6.0-rc2
- argo-cdBitnami
From 2.10.0 · fixed in 3.3.15; From 3.4.0 · fixed in 3.4.10; From 3.5.0 · fixed in 3.5.4
- github.com/argoproj/argo-cd/v2Go
From 2.10.0 · through 2.14.21
- github.com/argoproj/argo-cd/v3Go
From 3.0.0 · fixed in 3.3.15
- github.com/argoproj/argo-cd/v3Go
From 3.4.0 · fixed in 3.4.10
- github.com/argoproj/argo-cd/v3Go
From 3.5.0 · fixed in 3.5.4
- github.com/argoproj/argo-cd/v3Go
From 3.6.0-rc1 · fixed in 3.6.0-rc2
- github.com/argoproj/argo-cdGo
All versions
- github.com/argoproj/argo-cd/v2Go
From 2.10.0
- github.com/argoproj/argo-cd/v3Go
From 3.0.0 · fixed in 3.3.15; From 3.4.0 · fixed in 3.4.10; From 3.5.0 · fixed in 3.5.4; From 3.6.0-rc1 · fixed in 3.6.0-rc2