CVE-2022-24348: Path Traversal and Symlink Dereference in Argo CD
Summary
CVE-2022-24348: Path traversal and dereference of symlinks in Argo CD in github.com/argoproj/argo-cd. Affected versions are not published. No fix is published. How to fix ↓
Also tracked for
The same CVE-2022-24348 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Argo CD is an open-source continuous delivery tool for Kubernetes. It provides a declarative approach to managing applications and their configurations. Argo CD allows users to deploy and manage applications in a GitOps manner, ensuring that the desired state of the application matches the actual state in the cluster. This vulnerability affects the Argo CD package, specifically versions 0.x and 2.x.
Vulnerability Detail
The vulnerability in Argo CD allows for path traversal and dereference of symlinks. An attacker can exploit this vulnerability to access files outside of the intended directory or to follow symbolic links to sensitive files. This can lead to unauthorized access, information disclosure, or even remote code execution depending on the context in which Argo CD is deployed. The vulnerability was identified in the GitHub repository for Argo CD.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed versions mentioned above to mitigate the risk.
Conclusion
The path traversal and symlink dereference vulnerability in Argo CD can lead to unauthorized access and information disclosure. It is recommended to upgrade to the fixed versions of Argo CD to mitigate the risk. No workarounds are available for this vulnerability.
See every vulnerability recorded for github.com/argoproj/argo-cd →
FAQ
Argo CD is an open-source continuous delivery tool for Kubernetes that allows users to manage applications and their configurations in a GitOps manner.
Path traversal is a vulnerability that allows an attacker to access files or directories outside of the intended directory.
Symlink dereference is a vulnerability that occurs when a symbolic link is followed, leading to the access of unintended files or directories.
This vulnerability can result in unauthorized access to sensitive files, information disclosure, or even remote code execution depending on the context of Argo CD deployment.
No, there are no known workarounds for this vulnerability. It is crucial to upgrade to the fixed versions of Argo CD.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/argoproj/argo-cd.
