CVE-2022-24348

Summary

CVE-2022-24348 was a high-severity (CVSS 7.7) path traversal vulnerability in Argo CD, the GitOps continuous delivery tool for Kubernetes, discovered by Apiiro and disclosed in early February 2022, affecting Argo CD before 2.1.9 and 2.2.x before 2.2.4. An attacker with permission to create or update Argo CD applications could craft a malicious Kubernetes Helm chart whose values file was a symbolic link pointing outside the repository root, or pass arbitrary values files, so that when Argo CD's Helm chart processing dereferenced the link it read files belonging to other applications on the repo server. This broke the multi-tenant isolation boundary of the CD layer, letting the attacker exfiltrate sensitive data from neighboring tenants, including secrets in encrypted value files decrypted to disk by plugins such as git-crypt or SOPS, and use verbose Helm error messages to enumerate the filesystem. The issue was fixed in Argo CD 2.1.9, 2.2.4, and 2.3.0; it was treated as a zero-day at disclosure but was not associated with named ransomware operators.

How to avoid it in your code

• Upgrade Argo CD to 2.1.9, 2.2.4, or 2.3.0 (or later) immediately.
• Restrict application create/update permissions to trusted operators only.
• Isolate tenants onto separate repo-server instances where strong isolation is required.
• Avoid storing decryptable secrets on the Argo CD repo-server filesystem.
• Rotate any secrets that may have been exposed via cross-tenant file reads.

References

• https://github.com/advisories/GHSA-63qx-x74g-jcr7
• https://nvd.nist.gov/vuln/detail/CVE-2022-24348
• https://www.theregister.com/2022/02/04/argo_cd_0day_kubernetes/