Jannfis

تم اكتشاف ثغرة أمنية في Argo CD تؤدي إلى كشف القيم السرية في رسائل الخطأ وعرض الفروق (diff view) عند مزامنة مورد Kubernetes Secret غير صالح من مستودع. تفترض هذه الثغرة أن المستخدم يتمتع بحق الوصول للكتابة إلى المستودع ويمكنه استغلالها، سواء عن قصد أو عن غير قصد، عن طريق إرسال Secret غير صالح إلى المستودع وتشغيل عملية المزامنة. وبمجرد استغلالها، يمكن لأي مستخدم يتمتع بحق الوصول للقراءة إلى Argo CD عرض البيانات السرية المكشوفة.

The issue is related to an improper certificate validation bug in Argo CD, which could cause it to trust a malicious OpenID Connect (OIDC) provider. This bug affects connections to OIDC providers and can be exploited by an attacker to conduct spoofing attacks. The vulnerability is related to the skipping of certificate verification when communicating with the OIDC provider, which opens Argo CD to various risks, such as a machine-in-the-middle attack.

The issue is related to the use of insufficiently random values in parameters in Oauth2/OIDC login flows, making it possible for an attacker to gain admin access to Argo CD. The attacks are difficult to accomplish but can have a high impact. The vulnerabilities are due to the use of a relatively-predictable seed in a non-cryptographically-secure pseudo-random number generator, and in some cases, using too short a value made the entropy even less sufficient. The vulnerable parameters include the `state` parameter, `code verifier` parameter, and `nonce` parameter.

A path traversal vulnerability in Argo CD allows a malicious user with read/write access to leak sensitive files from Argo CD's repo-server. A malicious Argo CD user who has been granted `create` or `update` access to Applications can leak the contents of any text file on the repo-server. By crafting a malicious Helm chart and using it in an Application, the attacker can retrieve the sensitive file's contents either as part of the generated manifests or in an error message. The attacker would have to know or guess the location of the target file. Sensitive files which could be leaked include files from another Application's source repositories or any secrets which have been mounted as files on the repo-server.

The issue is related to a path traversal bug compounded by an improper access control bug in Argo CD, allowing a malicious user with read-only repository access to leak sensitive files from Argo CD's repo-server. A malicious Argo CD user who has been granted `get` access for a repository containing a Helm chart can craft an API request to the "/api/v1/repositories/{repo url}/appdetails" endpoint to leak the contents of out-of-bounds files from the repo-server. The malicious payload would reference an out-of-bounds file, and the contents of that file would be returned as part of the response. Sensitive files which could be leaked include files from other Applications' source repositories or any secrets which have been mounted as files on the repo-server.

The issue is related to Cross-site Scripting (XSS) where a malicious SSO provider connected to Argo CD could send back a malicious error message containing JavaScript to the user. This could result in the execution of arbitrary JavaScript code on the client. The exploitation of this vulnerability is believed to be possible only when Argo CD is connected to a compromised or malicious SSO provider.