Vulnerability · Published Aug 23, 2023 · Assigned by GitHub_M
CVE-2023-40025Argo CD web terminal session doesn't expire
Medium 4.7
In plain English
A medium-severity security flaw in argo-cd from argoproj. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of Argo CD starting from version 2.6.0 have a bug where open web terminal sessions do not expire. This bug allows users to send any websocket messages even if the token has already expired. The most straightforward scenario is when a user opens the terminal view and leaves it open for an extended period. This allows the user to view sensitive information even when they should have been logged out already. A patch for this vulnerability has been released in the following Argo CD versions: 2.6.14, 2.7.12 and 2.8.1.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/argoproj/argo-cd | no fix listed | GO-2023-2018 |
| Go | github.com/argoproj/argo-cd/v2 | 2.6.14 | GHSA-c8xw-vjgf-94hr |
| Go | github.com/argoproj/argo-cd/v2 | 2.7.12 | GHSA-c8xw-vjgf-94hr |
| Go | github.com/argoproj/argo-cd/v2 | 2.8.1 | GHSA-c8xw-vjgf-94hr |
| Go | github.com/argoproj/argo-cd/v2 | 2.0.0-20230821201509-e047efa8f951 | GHSA-c8xw-vjgf-94hr |
| Go | github.com/argoproj/argo-cd/v2 | 2.6.14, 2.7.12, 2.8.1 | GO-2023-2018 |
Affected products (as reported)
Weakness: CWE-613 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L