Hello everyone! This is an IT security information blog that quickly delivers the latest security information for your safe IT environment. π Today, we will delve into a critical vulnerability, CVE-2022-24348, found in Argo CD, a widely used open-source continuous deployment (CD) tool in GitOps environments.
π€ What exactly is CVE-2022-24348?
CVE-2022-24348 is a Path Traversal vulnerability. By exploiting this vulnerability, an attacker can access unauthorized directories (folders) and steal sensitive information. πβ‘οΈπ
Argo CD is a very useful tool that automates application deployment in Kubernetes environments. This vulnerability occurs during Argo CD’s processing of Helm charts. An attacker can manipulate the file system of the server where Argo CD is installed by using a maliciously crafted Helm chart.
The CVSS 3.1 score is 7.7, rated as ‘High’ severity. This means that the attack is relatively easy, and if successful, the impact of information leakage is significant. π±
βοΈ How does the attack work?
To help you understand, I’ll briefly explain the attack scenario.
- Attacker Preparation π: The attacker obtains permission to create or update applications in Argo CD. (Even low-level permissions are sufficient.)
- Malicious Helm Chart Creation π: The attacker creates a Helm chart containing malicious paths, including characters like ../ to navigate to parent directories in the file system. This chart is designed to target specific sensitive information within the Argo CD server (e.g., YAML files containing secret values for other applications, API keys, database passwords).
- Application to Argo CD π: The attacker deploys or updates an application containing this malicious Helm chart via Argo CD.
- Vulnerability Triggered! π₯: During the Helm chart rendering process, Argo CD’s path validation is insufficient, causing it to follow the malicious path specified by the attacker.
- Information Leakage π§: Consequently, the attacker can read and exfiltrate secret information or critical configuration files stored in locations that should not be accessible. This exfiltrated information can lead to larger-scale secondary and tertiary attacks.
The Key? π An attacker with appropriate permissions can use a maliciously crafted Helm chart to steal secret information used by other applications on the Argo CD server. This poses a significant threat to the Software Supply Chain.
π― Which versions are vulnerable?
If you are using the versions below, you are very likely exposed to the CVE-2022-24348 vulnerability. Check now!
- All 2.1.x versions below 2.1.9
- All 2.2.x versions below 2.2.4
π‘οΈ How to resolve it? (Most Important!)
Fortunately, this vulnerability can be resolved through a patch. The Argo CD development team promptly released security updates.
The solution is to upgrade Argo CD to the latest version! β¬οΈ
- v2.1.9 or higher
- v2.2.4 or higher
- v2.3.0 or higher
These versions all have patches applied for this vulnerability. To protect your valuable information, please check your current Argo CD version and update immediately!
βοΈ Concluding the Blog Post
As cloud-native and GitOps become mainstream, the importance of tools like Argo CD is growing daily. However, we must not forget that convenience comes with an equal measure of security importance. π€
CVE-2022-24348 is another reminder of how crucial continuous version management and security patch application are when using open-source tools. Please check your Argo CD version now and build a secure GitOps environment!
If you have any questions, please leave a comment anytime! π¬
Leave a Reply