Auth bypass in Argoproj Argo-Cd
CVE-2022-24768
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All unpatched versions of Argo CD starting with 1.0.0 are vulnerable to an improper access control bug, allowing a malicious user to potentially escalate their privileges to admin-level. Versions starting with 0.8.0 and 0.5.0 contain limited versions of this issue. To perform exploits, an authorized Argo CD user must have push access to an Application's source git or Helm repository or `sync` and `override` access to an Application. Once a user has that access, different exploitation levels are possible depending on their other RBAC privileges. A patch for this vulnerability has been released in Argo CD versions 2.3.2, 2.2.8, and 2.1.14. Some mitigation measures are available but do not serve as a substitute for upgrading. To avoid privilege escalation, limit who has push access to Application source repositories or `sync` + `override` access to Applications; and limit which repositories are available in projects where users have `update` access to Applications. To avoid unauthorized resource inspection/tampering, limit who has `delete`, `get`, or `action` access to Applications.
Vulnerability class: Information Disclosure
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.9 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.013 (69.0th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 69th percentile — 69.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.013 · newest: 0.013 · change: 0.000
Affected products
- Argoproj Argo-Cd — versions >= 0.5.0, < 2.1.14, >= 2.2.0, < 2.2.8, >= 2.3.0, < 2.3.2
- Argoproj Argo Cd
Weakness classification (CWE)
Public proof-of-concept exploits
References
- github.com/argoproj/argo-cd/security/advisories/GHSA-2f5v-8r3f-8pww (Third Party Advisory, Mitigation)
- github.com/argoproj/argo-cd/commit/af03b291d4b7e9d3ce9a6580ae9c8141af0e05cf (Patch, Third Party Advisory)
- github.com/argoproj/argo-cd/releases/tag/v2.1.14 (Third Party Advisory, Release Notes)
- github.com/argoproj/argo-cd/releases/tag/v2.2.8 (Third Party Advisory, Release Notes)
- github.com/argoproj/argo-cd/releases/tag/v2.3.2 (Third Party Advisory, Release Notes)
Frequently asked questions
- What is CVE-2022-24768?
- CVE-2022-24768 is a critical-severity vulnerability in Argoproj Argo-Cd, classified under Information Disclosure. CVSS score: 9.9/10. Published 2022-03-23.
- How severe is CVE-2022-24768?
- Critical severity. CVSS v3 base score is 9.9 out of 10.
- Is CVE-2022-24768 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.