Crenshaw-Dev

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. It’s possible for authenticated users to enumerate clusters by name by inspecting error messages. It’s also possible to enumerate the names of projects with project-scoped clusters if you know the names of the clusters. This issue can be exploited by sending requests to specific API endpoints, such as 'https://localhost:8080/api/v1/clusters/in-cluster?id.type=name', and analyzing the error messages returned.

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The API server does not enforce project sourceNamespaces, which allows attackers to use the UI to edit resources that should only be mutable via gitops. An attacker can exploit this by creating an Application in a specific namespace, changing its project, and then using the UI to edit the resource.

The issue is related to a Denial of Service (DoS) vulnerability via Out of Memory (OOM) using jq in ignoreDifferences. This vulnerability can be exploited by a remote attacker, allowing them to cause a service disruption. The vulnerability is associated with uncontrolled resource consumption when processing the `jqPathExpressions` parameter.

The issue is related to improper validation in Argo CD, a declarative, GitOps continuous delivery tool for Kubernetes. This allows users with `create` privileges but not `override` privileges to sync local manifests on app creation, bypassing the restriction that the manifests come from some approved git/Helm/OCI source. The "local sync" feature, which allows developers to temporarily override an Application's manifests with locally-defined manifests, is affected. This feature should generally be limited to highly-trusted users, as it allows the user to bypass any merge protections in git.

Argo CD is a declarative continuous deployment framework for Kubernetes. The issue allows an attacker to reference external Helm charts handled by the same repo-server to leak values or files from the referenced Helm Chart using a specifically-crafted Helm file. This is possible because Helm paths were predictable, allowing an attacker to add a Helm chart that references Helm resources from predictable paths. As a result, it is possible to reference and render the values and resources from other existing Helm charts, regardless of permissions. Although secrets are generally not stored in these files, it is still possible to reference any values from these charts.

The issue is related to an improper authorization bug in Argo CD, a declarative, GitOps continuous delivery tool for Kubernetes. This bug allows users who have the ability to update at least one cluster secret to update any cluster secret. An attacker could use this access to escalate privileges, potentially controlling Kubernetes resources, or to break Argo CD functionality by preventing connections to external clusters. The vulnerability can be exploited by an attacker who is authenticated with the Argo CD API server and has access to update at least one cluster configuration. The attacker can craft a malicious request to the Argo CD API server, potentially allowing them to manage out-of-bounds resources, disable certificate verification for TLS connections, or apply an invalid configuration to achieve a denial-of-service.

The issue is related to an output sanitization bug in Argo CD, which leaks repository access credentials in error messages. These error messages are visible to the user and are logged. The error message is visible when a user attempts to create or update an Application via the Argo CD API. The user must have `applications, create` or `applications, update` RBAC access to reach the code that may produce the error.

The issue is related to an improper certificate validation bug in Argo CD, which could cause it to trust a malicious OpenID Connect (OIDC) provider. This bug affects connections to OIDC providers and can be exploited by an attacker to conduct spoofing attacks. The vulnerability is related to the skipping of certificate verification when communicating with the OIDC provider, which opens Argo CD to various risks, such as a machine-in-the-middle attack.

The issue is related to the use of insufficiently random values in parameters in Oauth2/OIDC login flows, making it possible for an attacker to gain admin access to Argo CD. The attacks are difficult to accomplish but can have a high impact. The vulnerabilities are due to the use of a relatively-predictable seed in a non-cryptographically-secure pseudo-random number generator, and in some cases, using too short a value made the entropy even less sufficient. The vulnerable parameters include the `state` parameter, `code verifier` parameter, and `nonce` parameter.

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. A malicious user with repository write access can leak sensitive files from Argo CD's repo-server due to a symlink following bug. This can include manifest files from other Applications' source repositories or any JSON-formatted secrets mounted as files on the repo-server. A malicious Argo CD user with write access for a repository which is (or may be) used in a directory-type Application may commit a symlink which points to an out-of-bounds file. Sensitive files which could be leaked include manifest files from other Applications' source repositories (potentially decrypted files, if you are using a decryption plugin) or any JSON-formatted secrets which have been mounted as files on the repo-server.