PT-2022-4053 · Argo Cd · Argo Cd

Adam Korczynski

+3

·

Published

2022-07-12

·

Updated

2024-08-21

·

CVE-2022-31105

CVSS v2.0

10

High

VectorAV:N/AC:L/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions Argo CD versions 0.4.0 through 2.2.10 Argo CD versions 2.3.0 through 2.3.5 Argo CD versions 2.4.0 through 2.4.4
Description The issue is related to an improper certificate validation bug in Argo CD, which could cause it to trust a malicious OpenID Connect (OIDC) provider. This bug affects connections to OIDC providers and can be exploited by an attacker to conduct spoofing attacks. The vulnerability is related to the skipping of certificate verification when communicating with the OIDC provider, which opens Argo CD to various risks, such as a machine-in-the-middle attack.
Recommendations For Argo CD versions 0.4.0 through 2.2.10, update to version 2.2.11 or later. For Argo CD versions 2.3.0 through 2.3.5, update to version 2.3.6 or later. For Argo CD versions 2.4.0 through 2.4.4, update to version 2.4.5 or later. As a temporary workaround for users of an external OIDC provider, consider setting the oidc.config.rootCA field in the argocd-cm ConfigMap to force certificate validation when the API server handles login flows.

Exploit

Fix

Improper Certificate Validation

Weakness Enumeration

Related Identifiers

BDU:2022-04887
CVE-2022-31105
GHSA-7943-82JG-WMW5
GO-2022-0518

Affected Products

Argo Cd