Vulnerability · Published Sep 7, 2023 · Assigned by GitHub_M
CVE-2023-40029Cluster secret might leak in cluster details page in Argo CD
Critical 9.9
In plain English
A critical-severity information exposure in argo-cd from argoproj. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 68% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
Argo CD is a declarative continuous deployment for Kubernetes. Argo CD Cluster secrets might be managed declaratively using Argo CD / kubectl apply. As a result, the full secret body is stored in`kubectl.kubernetes.io/last-applied-configuration` annotation. pull request #7139 introduced the ability to manage cluster labels and annotations. Since clusters are stored as secrets it also exposes the `kubectl.kubernetes.io/last-applied-configuration` annotation which includes full secret body. In order to view the cluster annotations via the Argo CD API, the user must have `clusters, get` RBAC access. **Note:** In many cases, cluster secrets do not contain any actually-secret information. But sometimes, as in bearer-token auth, the contents might be very sensitive. The bug has been patched in versions 2.8.3, 2.7.14, and 2.6.15. Users are advised to upgrade. Users unable to upgrade should update/deploy cluster secret with `server-side-apply` flag which does not use or rely on `kubectl.kubernetes.io/last-applied-configuration` annotation. Note: annotation for existing secrets will require manual removal.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/argoproj/argo-cd | no fix listed | GO-2023-2049 |
| Go | github.com/argoproj/argo-cd/v2 | 2.6.15 | GHSA-fwr2-64vr-xv9m |
| Go | github.com/argoproj/argo-cd/v2 | 2.7.14 | GHSA-fwr2-64vr-xv9m |
| Go | github.com/argoproj/argo-cd/v2 | 2.8.3 | GHSA-fwr2-64vr-xv9m |
| Go | github.com/argoproj/argo-cd/v2 | 2.6.15, 2.7.14, 2.8.3 | GO-2023-2049 |
Affected products (as reported)
Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
References
- https://github.com/argoproj/argo-cd/security/advisories/GHSA-fwr2-64vr-xv9m x_refsource_CONFIRM
- https://github.com/argoproj/argo-cd/pull/7139 x_refsource_MISC
- https://github.com/argoproj/argo-cd/commit/4b2e5b06bff2ffd8ed1970654ddd8e55fc4a41c4 x_refsource_MISC