Misconfigured Argo Workflows in Kubernetes
Summary
GHSA-rc7p-gmvh-xfx2: Attack on Kubernetes via Misconfigured Argo Workflows. Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Argo Workflows is an open-source container-native workflow engine for orchestrating parallel jobs on Kubernetes. It provides a declarative way to define workflows and execute them in a distributed manner. Argo Workflows allows users to automate complex tasks and manage dependencies between different steps in a workflow. However, a misconfiguration in the Argo Server can lead to a vulnerability that allows remote users to execute arbitrary code on the Kubernetes cluster.
Vulnerability Detail
The vulnerability (GHSA-rc7p-gmvh-xfx2) affects users running the Argo Server with the --auth-mode=server configuration, which is the default setting in versions prior to 3.0.0. If the Argo Server UI is exposed to the Internet, remote attackers can exploit this misconfiguration to execute arbitrary code on the cluster. This can result in various malicious activities, such as crypto-mining or unauthorized access to sensitive data.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, following the recommended steps mentioned in the 'how_to_fix' section should effectively address the issue.
Conclusion
The misconfiguration vulnerability in Argo Workflows can have serious consequences if the Argo Server UI is exposed to the Internet. It is crucial to follow the recommended steps to fix the vulnerability and ensure the security of your Kubernetes cluster. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/argoproj/argo-workflows →
FAQ
Argo Workflows is an open-source container-native workflow engine for orchestrating parallel jobs on Kubernetes. It provides a declarative way to define and execute workflows in a distributed manner.
The vulnerability allows remote users to execute arbitrary code on the Kubernetes cluster if the Argo Server UI is exposed to the Internet. This can lead to malicious activities such as crypto-mining or unauthorized access to sensitive data.
To mitigate the vulnerability, it is recommended to change the Argo Server configuration to use --auth-mode=client instead of --auth-mode=server. Additionally, avoid exposing the Argo Server UI to the Internet.
The vulnerability affects versions prior to 3.0.0 of Argo Server. Users of older 2.x versions are particularly advised to upgrade to version 3.x or later.
While there is no specific known exploit mentioned, the vulnerability can potentially be exploited by remote attackers if the Argo Server UI is exposed to the Internet and the server is running with the vulnerable configuration.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/argoproj/argo-workflows.
