CVE-2022-24905
Description
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. A vulnerability was found in Argo CD prior to versions 2.3.4, 2.2.9, and 2.1.15 that allows an attacker to spoof error messages on the login screen when single sign on (SSO) is enabled. In order to exploit this vulnerability, an attacker would have to trick the victim to visit a specially crafted URL which contains the message to be displayed. As far as the research of the Argo CD team concluded, it is not possible to specify any active content (e.g. Javascript) or other HTML fragments (e.g. clickable links) in the spoofed message. A patch for this vulnerability has been released in Argo CD versions 2.3.4, 2.2.9, and 2.1.15. There are currently no known workarounds.
How to fix
- argoproj argo_cd2.1.15, 2.2.9, 2.3.4 or later
- github.com/argoproj/argo-cd/v22.3.4, 2.2.9, 2.1.15 or later
- github.com/argoproj/argo-cd2.1.15 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| argoproj argo_cd | 0.6.1 ≤ v < 2.1.15, 2.2.0 ≤ v < 2.2.9, 2.3.0 ≤ v < 2.3.4 | 2.1.15, 2.2.9, 2.3.4 |
| github.com/argoproj/argo-cd/v2Go | 2.3.0 ≤ v < 2.3.4, 2.2.0 ≤ v < 2.2.9, 2.0.0 ≤ v < 2.1.15 | 2.3.4, 2.2.9, 2.1.15 |
| github.com/argoproj/argo-cdGo | v < 2.1.15, No range specified | 2.1.15 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.