PT-2024-35450 · Unknown · Argo Workflows Chart

Agilgur5 · Published 2024-11-21 · Updated 2024-11-22 · CVE-2024-52799

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Argo Workflows Chart versions prior to 0.44.0

Description The workflow-role in the Argo Workflows Chart has excessive privileges, including the ability to create pods/exec, which allows for arbitrary code execution within pods in the same namespace. If a user can be made to run a malicious template, their whole namespace can be compromised. This issue affects versions of the argo-workflows Chart that use appVersion: 3.4 and above, as well as users below 3.4 depending on their choice of Executor. The vulnerability is specific to the Helm Chart and does not affect the upstream manifests.

Recommendations For versions prior to 0.44.0, update to version 0.44.0 to fix the issue. As a temporary workaround, consider restricting the privileges of the workflow-role to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-1220

CWE-250

Related Identifiers

CVE-2024-52799

GHSA-FGRF-2886-4Q7M

Affected Products

Argo Workflows Chart

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/52xxx/CVE-2024-52799.json · Exploit
• https://osv.dev/vulnerability/CVE-2024-52799 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-52799 · Security Note
• https://github.com/argoproj/argo-helm/commit/81dc44c4a5ccd42c799469a78eb96a68048a4987 · Note
• https://github.com/argoproj/argo-helm/security/advisories/GHSA-fgrf-2886-4q7m · Note
• https://twitter.com/CVEnew/status/1859677185679987054 · Twitter Post
• https://twitter.com/SecPod/status/1859845487681208786 · Twitter Post