CVSS3
Attack Vector
ADJACENT
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
AI Score
Confidence
Low
EPSS
Percentile
13.0%
By default, the Redis database server is not password-protected. Consequently, an attacker with access to the Redis server can gain read/write access to the data in Redis. The attacker can also modify the βmfstβ (manifest) key to cause ArgoCD to execute any deployment, potentially leveraging ArgoCDβs high privileges to take over the cluster. Updating the βcacheEntryHashβ in the manifest JSON is necessary, but since it doesnβt use a private key for signing its integrity, a simple script can generate a new FNV64a hash matching the new manifest values. The repo-server, unable to verify if its cache is compromised, will read the altered βmfstβ key and initiate an update process for the injected deployment.
Itβs also possible to edit the βapp|resources-treeβ key, causing the ArgoCD server to load any Kubernetes resource into the live manifest section of the app preview. This could lead to an information leak.
The fact that the cache in Redis is neither signed nor validated, combined with Redisβs default lack of password protection, presents a significant security concern given ArgoCDβs high-level permissions within the cluster. A security update should ensure all Redis database values are signed or encrypted.
We began by deploying ArgoCD on an EKS cluster. Surprisingly, we discovered that an unprivileged pod in a different namespace on the same cluster could connect to the Redis server on port 6379. This was unexpected, as we had observed network policy rules restricting access to the Redis server to only the pods application-controller, repo-server, and argocd-server. We later realized that, despite having installed the latest version of the VPC CNI plugin on the EKS cluster, it requires manual enablement through configuration to enforce network policies. This raises concerns that many clients might unknowingly have open access to their Redis servers. We also know your recommendation on this page Argo CD - Secret Management, to enable the network policy plugin.
Further investigation revealed that any pod within my cluster could connect to the Redis server by resolving its address using the Kubernetes DNS server. Exploring the contents of the Redis server, we found that we could edit the βmfstβ value of the latest revision. By updating the βcacheEntryHashβ, we made the repo-server accept it as a legitimate cache, leading ArgoCD to apply this configuration.
These tests were conducted using the default configuration, with regular ArgoCD and ArgoCD via helm deployment. This scenario presents a viable attack path, enabling any pod with access to the cluster to potentially exploit ArgoCDβs high permissions and take over the cluster. We believe there is a critical need to enhance the security of the cache and its components. Given that many clients likely use ArgoCD in a plug-and-play manner, they could be exposed to significant risk. I am willing to offer assistance or answer any questions you might have.
We tested this using the latest version of ArgoCD, configured with default settings. ArgoCD was installed either by applying a YAML file or through Helm. We wrote a few Go programs to decompress the Redis values and regenerate the βcacheEntryHashβ, but these programs were relatively straightforward.
To modify the cluster deployment, you can alter the βmfstβ key of the latest revision. For instance, add the following line:
{"apiVersion":"apps/v1","kind":"Deployment","metadata":{"labels":{"app.kubernetes.io/instance":"myapp1"},"name":"everything-allowed"},"spec":{"replicas":1,"selector":{"matchLabels":{"app":"everything-allowed"}},"template":{"metadata":{"labels":{"app":"everything-allowed"}},"spec":{"containers":[{"args":["while true; do sleep 30; done;"],"command":["/bin/sh","-c","--"],"image":"ubuntu","name":"everything-allowed-pod","securityContext":{"privileged":true},"volumeMounts":[{"mountPath":"/host","name":"noderoot"}]}],"hostIPC":true,"hostNetwork":true,"hostPID":true,"volumes":[{"hostPath":{"path":"/"},"name":"noderoot"}]}}}
This addition creates a highly privileged pod.
To cause the web page to load a different Kubernetes resource in the βLive Manifestβ, edit the βapp|resources-treeβ manifest. Modify one of the componentβs kind, namespace, and name. Upon reloading the web page and clicking on the newly created asset, an error message appears: βUnable to load data: argocd-secret not found as part of application myapp.β However, the resourceβs description is still transmitted to the browser, as seen in this URL format:
https://127.0.0.1:8081/api/v1/applications/myapp/resource?name=argocd-secret&appNamespace=argocd&namespace=argocd&resourceName=argocd-secret&version=v1&kind=Secret&group=
This situation results in information leakage.
This vulnerability could lead to Privilege Escalation to the level of cluster controller, or to information leakage, affecting anyone who does not have strict access controls on their Redis instance.
github.com/advisories/GHSA-9766-5277-j5hr
github.com/argoproj/argo-cd/commit/2de0ceade243039c120c28374016c04ff9590d1d
github.com/argoproj/argo-cd/commit/35a7d6c7fa1534aceba763d6a68697f36c12e678
github.com/argoproj/argo-cd/commit/4e2fe302c3352a0012ecbe7f03476b0e07f7fc6c
github.com/argoproj/argo-cd/commit/53570cbd143bced49d4376d6e31bd9c7bd2659ff
github.com/argoproj/argo-cd/commit/6ef7b62a0f67e74b4aac2aee31c98ae49dd95d12
github.com/argoproj/argo-cd/commit/9552034a80070a93a161bfa330359585f3b85f07
github.com/argoproj/argo-cd/commit/bdd889d43969ba738ddd15e1f674d27964048994
github.com/argoproj/argo-cd/commit/f1a449e83ee73f8f14d441563b6a31b504f8d8b0
github.com/argoproj/argo-cd/security/advisories/GHSA-9766-5277-j5hr
nvd.nist.gov/vuln/detail/CVE-2024-31989