PT-2023-5114 · Argo Cd · Argo Cd

Farcaller + 1 · Published 2023-01-25 · Updated 2024-08-20 · CVE-2023-22482

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Argo CD versions 1.8.2 through 2.3.12 Argo CD versions 2.4.0 through 2.4.18 Argo CD versions 2.5.0 through 2.5.5 Argo CD versions 2.6.0-rc0 through 2.6.0-rc2

Description The issue is related to an improper authorization bug in Argo CD, causing the API to accept certain invalid tokens. OIDC providers include an aud (audience) claim in signed tokens, specifying the intended audience of the token. However, Argo CD does not validate the audience claim, allowing it to accept tokens not intended for Argo CD. If the configured OIDC provider serves other audiences, Argo CD will accept a token intended for one of those other audiences and grant user privileges based on the token's groups claim. This bug increases the impact of a stolen token, as an attacker can use a valid token for a different audience to access Argo CD.

Recommendations For versions 1.8.2 through 2.3.12, update to version 2.3.13 or later. For versions 2.4.0 through 2.4.18, update to version 2.4.19 or later. For versions 2.5.0 through 2.5.5, update to version 2.5.6 or later. For versions 2.6.0-rc0 through 2.6.0-rc2, update to version 2.6.0-rc3 or later. As a temporary workaround, consider configuring the allowedAudiences option in the OIDC config block to specify the intended audiences for the token.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

BDU:2023-05691

CVE-2023-22482

GHSA-Q9HR-J4RF-8FJC

GO-2023-1520

Affected Products

Argo Cd

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/22xxx/CVE-2023-22482.json · Exploit
• https://github.com/argoproj/argo-cd/security/advisories/GHSA-q9hr-j4rf-8fjc · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-22482 · Security Note
• https://osv.dev/vulnerability/CVE-2023-22482 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-q9hr-j4rf-8fjc · Vendor Advisory
• https://osv.dev/vulnerability/GO-2023-1520 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-05691 · Security Note
• https://github.com/argoproj/argo-cd · Note
• https://t.me/cibsecurity/57009 · Telegram Post
• https://t.me/pentestingnews/32552 · Telegram Post
• https://access.redhat.com/security/cve/CVE-2023-22482 · Note