PT-2024-2316 · Argo Cd · Argo Cd

Nadava669 · Published 2024-03-18 · Updated 2025-01-09 · CVE-2024-21661

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Argo CD versions prior to 2.8.13 Argo CD versions prior to 2.9.9 Argo CD versions prior to 2.10.4

Description The issue arises from unsafe manipulation of an array in a multi-threaded environment, where an array is being modified while it is being iterated over. This is a classic programming error but becomes critically unsafe when executed in a multi-threaded environment. When two threads interact with the same array simultaneously, the application crashes. The vulnerability is rooted in the application's code, specifically in the expireOldFailedAttempts() function. Any attacker can crash the application continuously, making it impossible for legitimate users to access the service. The issue is exacerbated because it does not require authentication, widening the pool of potential attackers.

Recommendations To resolve the issue for versions prior to 2.8.13, update to version 2.8.13 or later. To resolve the issue for versions prior to 2.9.9, update to version 2.9.9 or later. To resolve the issue for versions prior to 2.10.4, update to version 2.10.4 or later. As a temporary workaround, consider disabling the expireOldFailedAttempts() function until a patch is available.

Exploit

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

BDU:2024-02250

BIT-ARGO-CD-2024-21661

CVE-2024-21661

GHSA-6V85-WR92-Q4P7

GO-2024-2654

RHSA-2024:1752

Affected Products

Argo Cd

References · 15

• 🔥 https://github.com/argoproj/argo-cd/security/advisories/GHSA-6v85-wr92-q4p7 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/21xxx/CVE-2024-21661.json · Exploit
• https://github.com/argoproj/argo-cd/commit/2a22e19e06aaf6a1e734443043310a66c234e345 · Patch
• https://github.com/argoproj/argo-cd/commit/5bbb51ab423f273dda74ab956469843d2db2e208 · Patch
• https://github.com/argoproj/argo-cd/commit/ce04dc5c6f6e92033221ec6d96b74403b065ca8b · Patch
• https://osv.dev/vulnerability/GHSA-6v85-wr92-q4p7 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-02250 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-21661 · Security Note
• https://osv.dev/vulnerability/GO-2024-2654 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-21661 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-argo-cd-2024-21661 · Vendor Advisory
• https://github.com/argoproj/argo-cd · Note
• https://github.com/argoproj/argo-cd/blob/54601c8fd30b86a4c4b7eb449956264372c8bde0/util/session/sessionmanager.go#L302-L311 · Note
• https://twitter.com/VulmonFeeds/status/1769829595073626178 · Twitter Post
• https://twitter.com/CVEnew/status/1769826050085929430 · Twitter Post