CVE-2024-22424
📋 TL;DR
This CSRF vulnerability in Argo CD allows attackers to execute API requests on behalf of authenticated users when they can inject HTML on the same parent domain. It affects organizations hosting Argo CD on internal subdomains where attackers might gain web content control. The vulnerability bypasses browser CORS protections by manipulating content-type headers.
💻 Affected Systems
- Argo CD
📦 What is this software?
Argo Cd by Argoproj
Argo Cd by Argoproj
Argo Cd by Argoproj
Argo Cd by Linuxfoundation
⚠️ Risk & Real-World Impact
Worst Case
Attackers could deploy malicious applications to Kubernetes clusters, potentially leading to full cluster compromise, data exfiltration, or ransomware deployment.
Likely Case
Attackers with internal network access could deploy unauthorized applications or modify existing deployments to run malicious code.
If Mitigated
With proper network segmentation and strict access controls, impact would be limited to specific applications or namespaces.
🎯 Exploit Status
Requires attacker to control HTML content on same parent domain and trick authenticated user into visiting malicious page.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.10-rc2, 2.9.4, 2.8.8, or 2.7.15
Vendor Advisory: https://github.com/argoproj/argo-cd/security/advisories/GHSA-92mw-q256-5vwg
Restart Required: Yes
Instructions:
1. Identify current Argo CD version. 2. Upgrade to patched version matching your major.minor track. 3. Restart Argo CD components. 4. Verify API now rejects non-GET requests without application/json Content-Type.
🔧 Temporary Workarounds
No workarounds available
allVendor states there are no known workarounds for this vulnerability
🧯 If You Can't Patch
- Implement strict network segmentation to prevent attackers from accessing sibling subdomains
- Deploy web application firewall rules to block requests with suspicious content-type headers
🔍 How to Verify
Check if Vulnerable:
Check if Argo CD version is below 2.10-rc2, 2.9.4, 2.8.8, or 2.7.15 and test if API accepts POST requests with text/plain content-type containing JSON.Check Version:
argocd version --client && argocd version --serverVerify Fix Applied:
Test that API now rejects non-GET requests without application/json Content-Type header.📡 Detection & Monitoring
Log Indicators:
- API requests with non-standard content-types (text/plain) on POST/PUT endpoints
- Unexpected application creation or modification events
Network Indicators:
- Cross-origin requests from sibling subdomains with manipulated content-type headers
SIEM Query:
source="argo-cd" AND (content_type="text/plain" OR content_type!="application/json") AND (method="POST" OR method="PUT")🔗 References
- https://github.com/argoproj/argo-cd/issues/2496
- https://github.com/argoproj/argo-cd/pull/16860
- https://github.com/argoproj/argo-cd/security/advisories/GHSA-92mw-q256-5vwg
- https://github.com/argoproj/argo-cd/issues/2496
- https://github.com/argoproj/argo-cd/pull/16860
- https://github.com/argoproj/argo-cd/security/advisories/GHSA-92mw-q256-5vwg
