CVE-2023-50726: Users with `create` but not `override` privileges can perform local sync in argo-cd
Impact
"Local sync" is an Argo CD feature that allows developers to temporarily override an Application's manifests with locally-defined manifests. Use of the feature should generally be limited to highly-trusted users, since it allows the user to bypass any merge protections in git.
An improper validation bug allows users who have create privileges but not override privileges to sync local manifests on app creation. All other restrictions, including AppProject restrictions are still enforced. The only restriction which is not enforced is that the manifests come from some approved git/Helm/OCI source.
The bug was introduced in 1.2.0-rc1 when the local manifest sync feature was added.
Patches
The bug has been patched in the following versions:
2.10.3 2.9.8 2.8.12
Workarounds
To immediately mitigate the risk of branch protection bypass, remove applications, create RBAC access. The only way to eliminate the issue without removing RBAC access is to upgrade to a patched version.
Branch protection rules and review requirements are a great way to enforce security constraints in a GitOps environment, but they should be just one layer in a multi-layered approach. Make sure your AppProject and RBAC restrictions are as thorough as possible to prevent a review bypass vulnerability from permitting excessive damage.
References
Argo CD RBAC documentation
For more information
Open an issue in the Argo CD issue tracker or discussions Join us on Slack in channel #argo-cd
Other sources
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. "Local sync" is an Argo CD feature that allows developers to temporarily override an Application's manifests with locally-defined manifests. Use of the feature should generally be limited to highly-trusted users, since it allows the user to bypass any merge protections in git. An improper validation bug allows users who have create privileges but not override privileges to sync local manifests on app creation. All other restrictions, including AppProject restrictions are still enforced. The only restriction which is not enforced is that the manifests come from some approved git/Helm/OCI source. The bug was introduced in 1.2.0-rc1 when the local manifest sync feature was added. The bug has been patched in Argo CD versions 2.10.3, 2.9.8, and 2.8.12. Users are advised to upgrade. Users unable to upgrade may mitigate the risk of branch protection bypass by removing applications, create RBAC access. The only way to eliminate the issue without removing RBAC access is to upgrade to a patched version.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-50726?
CVE-2023-50726 is considered to have a high severity as it allows local overrides of application manifests, potentially leading to unauthorized changes.
How do I fix CVE-2023-50726?
To mitigate CVE-2023-50726, upgrade to Argo CD version 2.10.3, 2.9.8, or 2.8.12 depending on your current version.
What feature does CVE-2023-50726 affect in Argo CD?
CVE-2023-50726 affects the 'local sync' feature in Argo CD that allows users to override application manifests locally.
Who should be granted access to the local sync feature affected by CVE-2023-50726?
Access to the local sync feature should be limited to highly-trusted users to prevent bypassing merge protections.
What versions of Argo CD are impacted by CVE-2023-50726?
CVE-2023-50726 affects multiple versions of Argo CD, specifically from version 1.2.0-rc1 up to 2.10.3.