CVE-2020-8828: Improper Authentication and Insecure Default Initialization of Resource in Argo API
Summary
CVE-2020-8828: Argo CD Insecure default administrative password. Affects github.com/argoproj/argo-cd versions < 1.8.0. No fix is published. How to fix ↓
Also tracked for
- argo-cd · Bitnami
The same CVE-2020-8828 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Argo is an open-source project written in Go that provides a declarative continuous delivery tool for Kubernetes. It allows users to define and manage their applications, configurations, and deployments in a GitOps manner. Argo has privileged roles within a Kubernetes cluster, making it a valuable target for attackers seeking privilege escalation.
Vulnerability Detail
The vulnerability (CVE-2020-8828) arises from the improper authentication and insecure default initialization of resources in the Argo API. Starting from version 1.5.0, the default admin password is set to the argocd-server pod name. This means that insiders with access to the cluster or logs can abuse this issue for privilege escalation. While the most realistic threat is a malicious insider, it's important to note that pod names are not meant to be kept secret and could be exposed in various ways.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can manually change the default admin password to a strong and unique value. This can be done by modifying the argocd-server pod configuration or using the Argo API to update the password. Here is an example of how to update the password using the Argo API:
$ argocd account update-password --account admin
New password: <enter new password>
Confirm new password: <confirm new password>
Note that this workaround is not a permanent solution and should be followed by upgrading to a fixed version of Argo.
Conclusion
In conclusion, the vulnerability (CVE-2020-8828) in Argo API arises from improper authentication and insecure default initialization of resources. It can be exploited by insiders with access to the cluster or logs for privilege escalation. To mitigate this vulnerability, it is recommended to upgrade to a fixed version of Argo beyond 1.5.0 and follow the provided workaround if necessary. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for github.com/argoproj/argo-cd →
FAQ
Argo is an open-source project that provides a declarative continuous delivery tool for Kubernetes. It allows users to define and manage their applications, configurations, and deployments in a GitOps manner.
This vulnerability allows insiders with access to the cluster or logs to abuse the insecure default initialization of resources in the Argo API for privilege escalation. It can lead to unauthorized access and potential compromise of the Kubernetes cluster.
Users of Argo versions 0 to 1.5.0 are affected by this vulnerability. It is important to upgrade to a fixed version to mitigate the risk.
Yes, a workaround is available. Users can manually change the default admin password to a strong and unique value. However, this should be followed by upgrading to a fixed version of Argo as the workaround is not a permanent solution.
For more information about this vulnerability, you can refer to the official GitHub advisory: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/07/GHSA-h8jc-jmrf-9h8f/GHSA-h8jc-jmrf-9h8f.json
Related vulnerabilities
Recent vulnerabilities recorded for github.com/argoproj/argo-cd.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
