Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From versions 3.2.0 to before 3.2.11 and 3.3.0 to before 3.3.9, there is a missing authorization and data-masking gap in Argo CD's ServerSideDiff endpoint that allows an attacker with read-only access to extract plaintext Kubernetes Secret data from etcd via the Kubernetes API server's Server-Side Apply dry-run mechanism. This issue has been patched in versions 3.2.11 and 3.3.9.
The vulnerability results from a lack of proper authorization and data masking in the ServerSideDiff endpoint. This endpoint uses the Server-Side Apply dry-run mechanism available in the Kubernetes API Server. An attacker with read-only privileges can send a properly crafted request to this endpoint, which indirectly retrieves and returns data from Kubernetes Secret objects in plain text from the etcd storage, bypassing sensitive value masking mechanisms.
An attacker can gain full access to data stored in Kubernetes Secret objects in plaintext form, such as passwords, tokens, API keys, or certificates. The breach affects the confidentiality and integrity of data stored in the Kubernetes cluster.
Argo CD should be updated to version 3.2.11 or 3.3.9, in which the vulnerability has been fixed. Patches are available in the official project repository according to the provided references.
Argo CD in versions from 3.2.0 to 3.2.10 inclusive and from 3.3.0 to 3.3.8 inclusive.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:NArgoproj Argo Cd
APPArgoproj3.2.0 – 3.2.11 (excl.)3.3.0 – 3.3.9 (excl.)
Related vulnerabilities
Argo CD: nieuprawniony dostęp do poświadczeń repozytoriów przez API token
XSS w Argo CD — wykonanie akcji w imieniu ofiary via API
Argo CD: nieautoryzowany dostęp do Redis umożliwia privilege escalation
Argo CD: Ominięcie ochrony przed brute force logowania
Argo CD: XSS w adnotacjach linków umożliwia przejęcie uprawnień