Alexmt

Argo CD is a declarative continuous deployment for Kubernetes. Argo CD Cluster secrets might be managed declaratively using Argo CD / kubectl apply, resulting in the full secret body being stored in the `kubectl.kubernetes.io/last-applied-configuration` annotation. This exposes the annotation, which includes the full secret body, when managing cluster labels and annotations. To view cluster annotations via the Argo CD API, a user must have `clusters, get` RBAC access. In many cases, cluster secrets do not contain sensitive information, but sometimes, as in bearer-token auth, the contents might be very sensitive.

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All unpatched versions of Argo CD starting with 1.0.0 are vulnerable to an improper access control bug, allowing a malicious user to potentially escalate their privileges to admin-level. To perform exploits, an authorized Argo CD user must have push access to an Application's source git or Helm repository or `sync` and `override` access to an Application. Once a user has that access, different exploitation levels are possible depending on their other RBAC privileges.

A path traversal vulnerability in Argo CD allows a malicious user with read/write access to leak sensitive files from Argo CD's repo-server. A malicious Argo CD user who has been granted `create` or `update` access to Applications can leak the contents of any text file on the repo-server. By crafting a malicious Helm chart and using it in an Application, the attacker can retrieve the sensitive file's contents either as part of the generated manifests or in an error message. The attacker would have to know or guess the location of the target file. Sensitive files which could be leaked include files from another Application's source repositories or any secrets which have been mounted as files on the repo-server.

The issue is related to a path traversal bug compounded by an improper access control bug in Argo CD, allowing a malicious user with read-only repository access to leak sensitive files from Argo CD's repo-server. A malicious Argo CD user who has been granted `get` access for a repository containing a Helm chart can craft an API request to the "/api/v1/repositories/{repo url}/appdetails" endpoint to leak the contents of out-of-bounds files from the repo-server. The malicious payload would reference an out-of-bounds file, and the contents of that file would be returned as part of the response. Sensitive files which could be leaked include files from other Applications' source repositories or any secrets which have been mounted as files on the repo-server.

The issue is related to an improper access control bug in Argo CD, allowing a malicious user to potentially escalate their privileges to admin-level. This can be achieved if the user has push access to an Application's source git or Helm repository or `sync` and `override` access to an Application. The exploitation levels vary depending on the user's other RBAC privileges, including `update`, `delete`, `get`, and `action` access to Applications. A related exploit is possible for a user with `get` access to an Application, allowing them to access any Event in the Application's destination cluster if they know the involved object's name, UID, and namespace.