8.6
CWE
862
Advisory Published
Updated

CVE-2023-22736: argo-cd Controller reconciles apps outside configured namespaces when sharding is enabled

First published: Thu Jan 26 2023(Updated: )

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Versions starting with 2.5.0-rc1 and above, prior to 2.5.8, and version 2.6.0-rc4, are vulnerable to an authorization bypass bug which allows a malicious Argo CD user to deploy Applications outside the configured allowed namespaces. Reconciled Application namespaces are specified as a comma-delimited list of glob patterns. When sharding is enabled on the Application controller, it does not enforce that list of patterns when reconciling Applications. For example, if Application namespaces are configured to be argocd-*, the Application controller may reconcile an Application installed in a namespace called other, even though it does not start with argocd-. Reconciliation of the out-of-bounds Application is only triggered when the Application is updated, so the attacker must be able to cause an update operation on the Application resource. This bug only applies to users who have explicitly enabled the "apps-in-any-namespace" feature by setting `application.namespaces` in the argocd-cmd-params-cm ConfigMap or otherwise setting the `--application-namespaces` flags on the Application controller and API server components. The apps-in-any-namespace feature is in beta as of this Security Advisory's publish date. The bug is also limited to Argo CD instances where sharding is enabled by increasing the `replicas` count for the Application controller. Finally, the AppProjects' `sourceNamespaces` field acts as a secondary check against this exploit. To cause reconciliation of an Application in an out-of-bounds namespace, an AppProject must be available which permits Applications in the out-of-bounds namespace. A patch for this vulnerability has been released in versions 2.5.8 and 2.6.0-rc5. As a workaround, running only one replica of the Application controller will prevent exploitation of this bug. Making sure all AppProjects' sourceNamespaces are restricted within the confines of the configured Application namespaces will also prevent exploitation of this bug.

Credit: security-advisories@github.com security-advisories@github.com

Affected SoftwareAffected VersionHow to fix
Linuxfoundation Argo-cd>=2.5.0<2.5.8
Linuxfoundation Argo-cd=2.6.0-rc1
Linuxfoundation Argo-cd=2.6.0-rc2
Linuxfoundation Argo-cd=2.6.0-rc3
Linuxfoundation Argo-cd=2.6.0-rc4
Argoproj Argo Cd>=2.5.0<2.5.8
Argoproj Argo Cd=2.6.0-rc1
Argoproj Argo Cd=2.6.0-rc2
Argoproj Argo Cd=2.6.0-rc3
Argoproj Argo Cd=2.6.0-rc4

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Frequently Asked Questions

  • What is CVE-2023-22736?

    CVE-2023-22736 is a vulnerability in Argo CD, a GitOps continuous delivery tool for Kubernetes, that allows a malicious user to deploy applications outside the configured allowed names.

  • Which versions of Argo CD are affected by CVE-2023-22736?

    Versions starting with 2.5.0-rc1 and above, prior to 2.5.8, and version 2.6.0-rc4 of Argo CD are affected by CVE-2023-22736.

  • What is the severity of CVE-2023-22736?

    CVE-2023-22736 has a severity rating of high (8.5).

  • How can the CVE-2023-22736 vulnerability be fixed?

    To fix the CVE-2023-22736 vulnerability, users should upgrade their Argo CD installations to versions 2.5.8 or higher, or version 2.6.1 or higher.

  • Where can I find more information about CVE-2023-22736?

    More information about CVE-2023-22736 can be found in the Argo CD security advisory: https://github.com/argoproj/argo-cd/security/advisories/GHSA-6p4m-hw2h-6gmw

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2024 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203