CVE-2022-29164: Argo Workflows HTML Artifact Script Injection
Summary
CVE-2022-29164: Privilege Escalation in argo-workflows. Affects argo-workflows across 2 version ranges.
>= 2.6.0, < 3.2.11
>= 3.3.0, < 3.3.5
Fixed in 3.2.11 or 3.3.5, depending on the release line you run. How to fix ↓
Also tracked for
The same CVE-2022-29164 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Argo Workflows is an open source container-native workflow engine designed for orchestrating parallel jobs on Kubernetes. It provides a platform for managing and executing workflows in a distributed environment. This vulnerability affects Argo Workflows versions 2.6.0 to 3.2.11 and versions 3.3.0 to 3.3.5. The vulnerability allows an attacker with insider access to the same cluster as the victim to create a malicious workflow that produces an HTML artifact containing a script. When the victim opens the deep-link to the artifact, the script runs and interacts with the Argo Server API, potentially compromising the victim's workflows and allowing the attacker to read information or manipulate workflows. It is important to note that the attacker must already have the ability to run their own workflows and possess knowledge about the victim's system.
Vulnerability Detail
The vulnerability in Argo Workflows allows an attacker to exploit the HTML artifact functionality to inject a script that utilizes XHR calls to interact with the Argo Server API. By sending a deep-link to the victim, the attacker can execute arbitrary actions on behalf of the victim, such as reading workflow information or creating and deleting workflows. This can lead to unauthorized access, data leakage, and disruption of the victim's workflows. It is crucial to upgrade to the fixed versions of Argo Workflows to mitigate this vulnerability.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.6.0, < 3.2.113.2.11 -
>= 3.3.0, < 3.3.53.3.5
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Conclusion
The HTML artifact script injection vulnerability in Argo Workflows can allow an attacker with insider access to the same cluster as the victim to compromise workflows and perform unauthorized actions. It is crucial to upgrade to the fixed versions (3.2.11 or 3.3.5) to mitigate this vulnerability and ensure the security of your workflows. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for argo-workflows →
FAQ
Argo Workflows is an open source container-native workflow engine used for orchestrating parallel jobs on Kubernetes. It provides a platform for managing and executing workflows in a distributed environment.
The vulnerability occurs due to the ability of an attacker with insider access to the same cluster as the victim to create a malicious workflow that produces an HTML artifact containing a script. When the victim opens the deep-link to the artifact, the script runs and interacts with the Argo Server API, potentially compromising the victim's workflows.
With this vulnerability, an attacker can read information about the victim's workflows, as well as create and delete workflows on behalf of the victim. This can lead to unauthorized access, data leakage, and disruption of the victim's workflows.
No evidence of this vulnerability being exploited in the wild has been found so far. However, it is important to upgrade to the fixed versions to ensure the security of your workflows.
To protect your Argo Workflows installation, it is recommended to upgrade to the fixed versions (3.2.11 or 3.3.5) as soon as possible. These versions address the vulnerability and prevent the exploitation of the HTML artifact script injection.
References
Related vulnerabilities
Recent vulnerabilities recorded for argo-workflows.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
