CVE-2024-28175: Cross-site scripting on application summary component in Argo CD
Summary
CVE-2024-28175: Cross-site scripting on application summary component. Affects github.com/argoproj/argo-cd versions >= 1.0.0, <= 1.8.7. No fix is published. How to fix ↓
Also tracked for
- argo-cd · Bitnami
The same CVE-2024-28175 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Argo CD is an open-source continuous delivery tool for Kubernetes. It provides a declarative approach to manage and deploy applications to Kubernetes clusters. The application summary component in Argo CD displays information about deployed applications, including links specified in the link.argocd.argoproj.io annotations. These links are vulnerable to cross-site scripting (XSS) attacks.
Vulnerability Detail
The vulnerability in Argo CD allows an attacker to inject a javascript: link in the UI, leading to cross-site scripting. When a victim user clicks on the malicious link, the injected script executes with the victim's permissions, which can include admin privileges. This enables the attacker to perform arbitrary actions on behalf of the victim, such as creating, modifying, and deleting Kubernetes resources. The vulnerability affects all unpatched versions of Argo CD starting from v1.0.0.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If upgrading Argo CD is not immediately possible, a workaround is to create a Kubernetes admission controller that rejects any resources with an annotation starting with link.argocd.argoproj.io or rejects the resource if the value uses an improper URL protocol. This validation should be applied in all clusters managed by Argo CD to mitigate the risk of cross-site scripting attacks.
Conclusion
The cross-site scripting vulnerability in Argo CD's application summary component can lead to unauthorized execution of scripts with elevated permissions. It is crucial to upgrade Argo CD to one of the patched versions or implement the recommended workaround to mitigate the risk. Regularly updating Argo CD and staying informed about security vulnerabilities is essential for maintaining a secure deployment. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for github.com/argoproj/argo-cd →
FAQ
The vulnerability allows an attacker to execute arbitrary scripts with the victim's permissions, which can include admin privileges. This enables the attacker to perform unauthorized actions on behalf of the victim, such as modifying or deleting Kubernetes resources.
The best way to protect your Argo CD installation is to upgrade to one of the patched versions: v2.10.3, v2.9.8, or v2.8.12. Regularly updating Argo CD to the latest patched version is crucial to ensure the security of your deployment.
If upgrading is not immediately possible, you can create a Kubernetes admission controller to reject resources with link.argocd.argoproj.io annotations or reject resources with improper URL protocols. This validation should be implemented in all clusters managed by Argo CD.
The recommended workaround is to create a Kubernetes admission controller to reject resources with vulnerable annotations or improper URL protocols. However, upgrading to a patched version of Argo CD is the most effective solution.
There is no known public exploit for this vulnerability at the time of disclosure. However, it is important to promptly upgrade Argo CD to the patched versions to prevent potential exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/argoproj/argo-cd.
