PT-2022-3255 · Argo Cd+1 · Argo Cd+1
Adam Korczynski
+1
·
Published
2022-06-15
·
Updated
2024-08-21
·
CVE-2022-31036
CVSS v2.0
5.5
Medium
| Vector | AV:A/AC:L/Au:S/C:N/I:C/A:N |
Name of the Vulnerable Software and Affected Versions
Argo CD versions 1.3.0 through 2.4.0
Argo CD versions 2.1.0 through 2.1.15
Argo CD versions 2.2.0 through 2.2.9
Argo CD versions 2.3.0 through 2.3.4
Description
The issue is related to a symlink following bug in Argo CD, allowing a malicious user with repository write access to leak sensitive YAML files from Argo CD's repo-server. A malicious Argo CD user with write access for a repository which is (or may be) used in a Helm-type Application may commit a symlink which points to an out-of-bounds file. If the target file is a valid YAML file, the attacker can read the contents of that file. Sensitive files which could be leaked include manifest files from other Applications' source repositories (potentially decrypted files, if you are using a decryption plugin) or any YAML-formatted secrets which have been mounted as files on the repo-server.
Recommendations
For versions 1.3.0 through 2.1.15, update to version 2.1.16 or later.
For versions 2.2.0 through 2.2.9, update to version 2.2.10 or later.
For versions 2.3.0 through 2.3.4, update to version 2.3.5 or later.
For versions 2.4.0 and earlier, update to version 2.4.1 or later.
As a temporary workaround, consider disabling the Helm config management tool if you are using a version >=v2.3.0 and do not have any Helm-type Applications.
Avoid mounting YAML-formatted secrets as files on the repo-server.
Limit who has push access to manifest repositories.
Limit who is allowed to configure new source repositories.
Exploit
Fix
Memory Corruption
Link Following
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Argo Cd
Helm