PT-2024-2260 · Argo Cd · Argo Cd

Nadava669 · Published 2024-03-18 · Updated 2025-01-09 · CVE-2024-21662

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Argo CD versions prior to 2.8.13 Argo CD versions prior to 2.9.9 Argo CD versions prior to 2.10.4

Description The issue is related to the mechanism of caching in Argo CD, which is a declarative, GitOps continuous delivery tool for Kubernetes. An attacker can exploit the application's weak cache-based mechanism to bypass the rate limit and brute force protections. This can be done by overflowing the cache, which tracks login attempts for each user and is limited to a defaultMaxCacheSize of 1000 entries, by bombarding it with login attempts for different users. This effectively resets the rate limit for the admin account, allowing attackers to perform brute force attacks at an accelerated rate.

Recommendations For versions prior to 2.8.13, upgrade to version 2.8.13 or later to receive a patch. For versions prior to 2.9.9, upgrade to version 2.9.9 or later to receive a patch. For versions prior to 2.10.4, upgrade to version 2.10.4 or later to receive a patch. As a temporary workaround, consider restricting access to the login functionality to minimize the risk of exploitation.

Exploit

Fix

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-307

Related Identifiers

BDU:2024-02193

BIT-ARGO-CD-2024-21652

BIT-ARGO-CD-2024-21662

CVE-2024-21662

GHSA-2VGG-9H6W-M454

GHSA-X32M-MVFJ-52XV

GO-2024-2652

RHSA-2024:1752

Affected Products

Argo Cd

References · 19

• 🔥 https://github.com/argoproj/argo-cd/security/advisories/GHSA-2vgg-9h6w-m454 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/21xxx/CVE-2024-21662.json · Exploit
• https://github.com/argoproj/argo-cd/commit/17b0df1168a4c535f6f37e95f25ed7cd81e1fa4d · Patch
• https://github.com/argoproj/argo-cd/commit/6e181d72b31522f886a2afa029d5b26d7912ec7b · Patch
• https://github.com/argoproj/argo-cd/commit/cebb6538f7944c87ca2fecb5d17f8baacc431456 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-21652 · Security Note
• https://osv.dev/vulnerability/BIT-argo-cd-2024-21652 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-x32m-mvfj-52xv · Vendor Advisory
• https://argo-cd.readthedocs.io/en/stable/security_considerations/#cve-2020-8827-insufficient-anti-automationanti-brute-force · Vendor Advisory
• https://osv.dev/vulnerability/GO-2024-2652 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-argo-cd-2024-21662 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-02193 · Security Note
• https://osv.dev/vulnerability/GHSA-2vgg-9h6w-m454 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-21662 · Security Note
• https://osv.dev/vulnerability/CVE-2024-21662 · Vendor Advisory