PT-2024-2558 · Argoproj · Argo Cd
Ry0Tak
·
Published
2024-03-13
·
Updated
2025-01-09
·
CVE-2024-28175
CVSS v3.1
9.0
Critical
| Vector | AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Argo CD versions 1.0.0 through 2.10.2
Argo CD versions 1.0.0 through 2.9.7
Argo CD versions 1.0.0 through 2.8.11
Description
Due to the improper URL protocols filtering of links specified in the
link.argocd.argoproj.io annotations in the application summary component, an attacker can achieve cross-site scripting with elevated permissions. This allows a malicious user to inject a javascript: link in the UI, which will execute with the victim's permissions (up to and including admin) when clicked. The vulnerability enables an attacker to perform arbitrary actions on behalf of the victim via the API, such as creating, modifying, and deleting Kubernetes resources.Recommendations
For Argo CD versions 1.0.0 through 2.10.2, upgrade to version 2.10.3 or later.
For Argo CD versions 1.0.0 through 2.9.7, upgrade to version 2.9.8 or later.
For Argo CD versions 1.0.0 through 2.8.11, upgrade to version 2.8.12 or later.
As a temporary workaround, consider creating a Kubernetes admission controller to reject any resources with an annotation starting with
link.argocd.argoproj.io or reject the resource if the value uses an improper URL protocol. This validation will need to be applied in all clusters managed by ArgoCD.Exploit
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Argo Cd