CVE-2024-28175: Cross-site scripting on application summary component in argo-cd
Summary
Due to the improper URL protocols filtering of links specified in the link.argocd.argoproj.io annotations in the application summary component, an attacker can achieve cross-site scripting with elevated permissions.
Impact
All unpatched versions of Argo CD starting with v1.0.0 are vulnerable to a cross-site scripting (XSS) bug allowing a malicious user to inject a javascript: link in the UI. When clicked by a victim user, the script will execute with the victim's permissions (up to and including admin).
This vulnerability allows an attacker to perform arbitrary actions on behalf of the victim via the API, such as creating, modifying, and deleting Kubernetes resources.
Patches A patch for this vulnerability has been released in the following Argo CD versions:
v2.10.3 v2.9.8 v2.8.12
Workarounds
There are no completely-safe workarounds besides upgrading. The safest alternative, if upgrading is not possible, would be to create a Kubernetes admission controller to reject any resources with an annotation starting with link.argocd.argoproj.io or reject the resource if the value use an improper URL protocol. This validation will need to be applied in all clusters managed by ArgoCD.
Mitigations
1. Avoid clicking external links presented in the UI. The link's title is user-configurable. So even if you hover the link, and the tooltip looks safe, the link might be malicious. The only way to be certain that the link is safe is to inspect the page's source. 2. Carefully limit who has permissions to edit Kubernetes resource manifests (this is configured in RBAC for ArgoCD). The external-links are set as annotations on Kubernetes resources. Any persona with write access to resources managed by ArgoCD could be an actor.
References Documentation for the external links feature
Credits
Disclosed by RyotaK (@Ry0taK)
For more information
- Open an issue in the Argo CD issue tracker or discussions - Join us on Slack in channel #argo-cd
Other sources
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Due to the improper URL protocols filtering of links specified in the link.argocd.argoproj.io annotations in the application summary component, an attacker can achieve cross-site scripting with elevated permissions. All unpatched versions of Argo CD starting with v1.0.0 are vulnerable to a cross-site scripting (XSS) bug allowing a malicious user to inject a javascript: link in the UI. When clicked by a victim user, the script will execute with the victim's permissions (up to and including admin). This vulnerability allows an attacker to perform arbitrary actions on behalf of the victim via the API, such as creating, modifying, and deleting Kubernetes resources. A patch for this vulnerability has been released in Argo CD versions v2.10.3 v2.9.8, and v2.8.12. There are no completely-safe workarounds besides upgrading. The safest alternative, if upgrading is not possible, would be to create a Kubernetes admission controller to reject any resources with an annotation starting with link.argocd.argoproj.io or reject the resource if the value use an improper URL protocol. This validation will need to be applied in all clusters managed by ArgoCD.
— NVD
Upstream is planning to lift the embargo status on March 14th. The following is the currently known information, will add more as it becomes available:
Impact Due to the improper filtering of URL protocols in the application summary component, an attacker can achieve cross-site scripting with permission to edit the application.
Patches A patch for this vulnerability has been released in the following Argo CD versions: v2.8, v2.9, v2.10
Workarounds: The only way to completely resolve the issue is to upgrade.
Mitigations - Avoid clicking external links presented in the UI. - The link's title is user-configurable. So even if you hover the link, and the tooltip looks safe, the link might be malicious. The only way to be certain that the link is safe is to inspect the page's source. - Carefully limit who has permissions to edit Kubernetes resource manifests (this is configured in RBAC for ArgoCD). - The external-links are set as annotations on Kubernetes resources. Any person with write access to resources managed by ArgoCD could be an actor.
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-28175?
CVE-2024-28175 is considered a critical vulnerability due to its potential for cross-site scripting with elevated permissions.
What versions are affected by CVE-2024-28175?
All unpatched versions of Argo CD from 1.0.0 to 1.8.7 and certain versions of Argo CD v2 prior to 2.8.12, 2.9.8, or 2.10.3 are affected by CVE-2024-28175.
How do I fix CVE-2024-28175?
To remediate CVE-2024-28175, update Argo CD to version 2.8.12, 2.9.8, or 2.10.3.
How does CVE-2024-28175 impact security?
CVE-2024-28175 could allow an attacker to exploit improper URL protocol filtering, leading to unauthorized actions on behalf of privileged users.
What should I do if I cannot immediately update for CVE-2024-28175?
If an immediate update is not possible for CVE-2024-28175, apply mitigation strategies such as restricting access to exposed Argo CD components.