CVE-2024-41666
📋 TL;DR
Argo CD's web terminal feature has a privilege persistence vulnerability where users retain container access even after their exec permissions are revoked, as long as they keep the terminal session open. This affects Argo CD administrators who enable the web terminal feature and users with exec permissions. The vulnerability could lead to unauthorized access to sensitive container data.
💻 Affected Systems
- Argo CD
📦 What is this software?
Argo Cd by Argoproj
Argo Cd by Argoproj
Argo Cd by Argoproj
⚠️ Risk & Real-World Impact
Worst Case
An attacker with revoked exec permissions maintains persistent access to production containers, potentially exfiltrating sensitive data, modifying configurations, or executing malicious commands.
Likely Case
Users who have had their exec permissions revoked unintentionally retain access to containers they should no longer have access to, leading to potential data exposure or unauthorized operations.
If Mitigated
With proper session management and monitoring, the impact is limited to temporary access persistence rather than permanent privilege escalation.
🎯 Exploit Status
Exploitation requires: 1) Web terminal enabled, 2) User had exec permissions, 3) Permissions revoked while terminal session active, 4) User maintains terminal session
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.11.7, 2.10.16, or 2.9.21
Vendor Advisory: https://github.com/argoproj/argo-cd/security/advisories/GHSA-v8wx-v5jq-qhhw
Restart Required: Yes
Instructions:
1. Backup your Argo CD configuration. 2. Upgrade to patched version using your deployment method (helm, kubectl, etc.). 3. Restart Argo CD components. 4. Verify version with 'argocd version' command.
🔧 Temporary Workarounds
Disable Web Terminal Feature
allDisable the vulnerable web terminal functionality entirely
argocd-cmd-params-cm configmap: set server.webterminal.enabled to false
Implement Session Timeout
allConfigure aggressive session timeouts for web terminal sessions
argocd-cmd-params-cm configmap: set server.session.timeout to lower value (e.g., 3600)
🧯 If You Can't Patch
- Disable web terminal feature immediately via configuration
- Implement strict RBAC auditing and force logout all active terminal sessions when permissions change
🔍 How to Verify
Check if Vulnerable:
Check Argo CD version with 'argocd version' and verify if between 2.6.0-2.11.6, 2.10.15, or 2.9.20 AND web terminal is enabledCheck Version:
argocd version | grep -i 'argocd:'Verify Fix Applied:
Verify version is 2.11.7, 2.10.16, or 2.9.21 with 'argocd version' and test permission revocation while terminal session is active📡 Detection & Monitoring
Log Indicators:
- Terminal sessions persisting after permission revocation events
- Exec commands from users with revoked permissions
Network Indicators:
- Sustained websocket connections to terminal endpoints after RBAC changes
SIEM Query:
source="argo-cd" AND ("permission revoked" OR "rbac update") AND "terminal session" NOT "session terminated"🔗 References
- https://drive.google.com/file/d/1Fynj5Sho8Lf8CETqsNXZyPKlTDdmgJuN/view?usp=sharing
- https://github.com/argoproj/argo-cd/commit/05edb2a9ca48f0f10608c1b49fbb0cf7164f6476
- https://github.com/argoproj/argo-cd/commit/e96f32d233504101ddac028a5bf8117433d333d6
- https://github.com/argoproj/argo-cd/commit/ef535230d8bd8ad7b18aab1ea1063e9751d348c4
- https://github.com/argoproj/argo-cd/security/advisories/GHSA-v8wx-v5jq-qhhw
- https://drive.google.com/file/d/1Fynj5Sho8Lf8CETqsNXZyPKlTDdmgJuN/view?usp=sharing
- https://github.com/argoproj/argo-cd/commit/05edb2a9ca48f0f10608c1b49fbb0cf7164f6476
- https://github.com/argoproj/argo-cd/commit/e96f32d233504101ddac028a5bf8117433d333d6
- https://github.com/argoproj/argo-cd/commit/ef535230d8bd8ad7b18aab1ea1063e9751d348c4
- https://github.com/argoproj/argo-cd/security/advisories/GHSA-v8wx-v5jq-qhhw
