Flash Report: High Severity Path-Traversal Vulnerability Affects Argo CD Users

Flash Report: High Severity Path-Traversal Vulnerability Affects Argo CD Users

A newly-discovered zero-day vulnerability in Argo CD, used by organizations for deploying applications to Kubernetes, can be leveraged in attacks to disclose sensitive information and continues to highlight ongoing issues with insecure software supply chains.

CVE-2022-24348 could allow an attacker to hop across multiple application-development environments and extract sensitive information, such as passwords, tokens, and API keys. The high-severity vulnerability affects all versions of the tool. Argo has released patches for this bug in versions 2.1.9, 2.2.4, and 2.3.0. Argo CD is used by at least 191 organizations; it is a continuous-delivery platform deployed as a Kubernetes controller in the cloud used to deploy applications and monitor them in real-time. At the moment, ZeroFox is not aware of any threat actors exploiting this vulnerability, however, one ransomware group circulated the disclosure on February 7, 2022—likely in an effort to raise awareness about the vulnerability.

As an increasing number of organizations are moving workloads to cloud resources and Kubernetes, this vulnerability once again underscores risks associated with insecure software supply chains. The issue is being tackled by organizations in the federal and private sectors; the White House recently hosted an open source security summit, with members from across both sectors convening to discuss how best to tackle flaws in community-driven software. On February 1, 2022, the Open Source Security Foundation (OpenSSF)—backed by the Linux Foundation, Microsoft, and Google—launched a new project designed to secure the software supply chain.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Recommendations

• Install updates from Argo CD, as there is no workaround.
• Regularly audit your tech stack to understand where your third party/supply chain vulnerabilities might be.

Details

The path-traversal vulnerability allows malicious actors to load a Kubernetes Helm Chart YAML file to the vulnerability and “hop” from their application ecosystem to other applications' data outside of the user's scope. The impact can become especially critical in environments that make use of encrypted value files (e.g., using plugins with git-crypt or SOPS) containing sensitive or confidential data and decrypting that information to disk before rendering the Helm chart. There are no workarounds for the issue, and Argo CD has urged its users to update their installations. Patches have been released for Argo CD v2.1.9, v2.2.4, and v2.3.0.

Successful exploitation of the vulnerability could have serious consequences ranging from privilege escalation and sensitive information disclosure to lateral movement attacks and exfiltration of tokens from other applications.

Figure 1. CVE-2022-24348 Attack Flow
Source: Apiiro

At the moment, ZeroFox is not aware of any threat actors exploiting this vulnerability, however, a news article generated some interest across covert channels and was re-posted to multiple chat platforms, including the private Telegram channel for a newly-emerged ransomware group called LAPSUS$. ZeroFox will continue to monitor for any further discussions.

Figure 2. Vulnerability disclosure posted to the LAPSUS$ private chat channel
Source: ZeroFox Threat Hunting Module