Internet Bug Bounty · Report #1847140

Argo CD reconciles apps outside configured namespaces when sharding is enabled

Validstatus

highseverity

$2,000bounty

18upvotes

5 Mar 2023disclosed

Summary

Controller reconciles apps outside configured namespaces when sharding is enabled

Impact All Argo CD versions starting with 2.5.0-rc1 are vulnerable to an authorization bypass bug which allows a malicious Argo CD user to deploy Applications outside the configured allowed namespaces.

Description of exploit Reconciled Application namespaces are specified as a comma-delimited list of glob patterns. When sharding is enabled on the Application controller, it does not enforce that list of patterns when reconciling Applications. For example, if Application namespaces are configured to be argocd-*, the Application controller may reconcile an Application installed in a namespace called other, even though it does not start with argocd-.

Reconciliation of the out-of-bounds Application is only triggered when the Application is updated, so the attacker must be able to cause an update operation on the Application resource.

Credits Thanks to ChangZhuo Chen (@czchen) for finding the issue and for contributing the fix!

Full GHSA: https://github.com/argoproj/argo-cd/security/advisories/GHSA-6p4m-hw2h-6gmw

How it was found

The Application CRD outside configured namespace in Argo CD will be reconciled.

The following is how to reproduce the vulnerability:

Enable apps-in-any-namespace and sharding features.
Create an Application CRD in namespace not configured in Argo CD.
Update the Application CRD, and Argo CD will reconcile the Application CRD, despite not in configured namespace.

Impact

Attacker can use Argo CD permission to deploy resources in Kubernetes.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original