CVE-2022-31036
published 2022-06-27CVE-2022-31036: Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of Argo CD starting with v1.3.0 are vulnerable to a symlink following…
PriorityP424medium4.3CVSS 3.1
AVNACLPRLUINSUCLINAN
EPSS
0.82%
52.7th percentile
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of Argo CD starting with v1.3.0 are vulnerable to a symlink following bug allowing a malicious user with repository write access to leak sensitive YAML files from Argo CD's repo-server. A malicious Argo CD user with write access for a repository which is (or may be) used in a Helm-type Application may commit a symlink which points to an out-of-bounds file. If the target file is a valid YAML file, the attacker can read the contents of that file. Sensitive files which could be leaked include manifest files from other Applications' source repositories (potentially decrypted files, if you are using a decryption plugin) or any YAML-formatted secrets which have been mounted as files on the repo-server. Patches for this vulnerability has been released in the following Argo CD versions: v2.4.1, v2.3.5, v2.2.10 and v2.1.16. If you are using a version >=v2.3.0 and do not have any Helm-type Applications you may disable the Helm config management tool as a workaround.
Affected
14 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| argoproj | argo-cd | — | — |
| argoproj | argo-cd | — | — |
| argoproj | argo-cd | — | — |
| argoproj | argo-cd | — | — |
| argoproj | argo_cd | — | — |
| argoproj | argo_cd | — | — |
| argoproj | argo_cd | — | — |
| argoproj | argo_cd | >= 1.3.0 < 2.1.6 | 2.1.6 |
| github.com | argoproj_argo-cd | >= 1.3.0 < 2.1.16 | 2.1.16 |
| github.com | argoproj_argo-cd | >= 1.3.0 | — |
| github.com | argoproj_argo-cd_v2 | >= 0 < 2.1.16 | 2.1.16 |
| github.com | argoproj_argo-cd_v2 | >= 2.2.0 < 2.2.10 | 2.2.10 |
| github.com | argoproj_argo-cd_v2 | >= 2.3.0 < 2.3.5 | 2.3.5 |
| github.com | argoproj_argo-cd_v2 | >= 2.4.0 < 2.4.1 | 2.4.1 |
CVSS provenance
nvdv3.14.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
nvdv2.04.0MEDIUMAV:N/AC:L/Au:S/C:P/I:N/A:N
vendor_redhat4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Symlink following allows leaking out-of-bounds YAML files from Argo CD repo-server in github.com/argoproj/argo-cd
osv·2024-08-21
CVE-2022-31036 Symlink following allows leaking out-of-bounds YAML files from Argo CD repo-server in github.com/argoproj/argo-cd
Symlink following allows leaking out-of-bounds YAML files from Argo CD repo-server in github.com/argoproj/argo-cd
Symlink following allows leaking out-of-bounds YAML files from Argo CD repo-server in github.com/argoproj/argo-cd
OSV
Symlink following allows leaking out-of-bounds YAML files from Argo CD repo-server
osv·2022-06-21
CVE-2022-31036 [MEDIUM] Symlink following allows leaking out-of-bounds YAML files from Argo CD repo-server
Symlink following allows leaking out-of-bounds YAML files from Argo CD repo-server
### Impact
All unpatched versions of Argo CD starting with v1.3.0 are vulnerable to a symlink following bug allowing a malicious user with repository write access to leak sensitive YAML files from Argo CD's repo-server.
A malicious Argo CD user with write access for a repository which is (or may be) used in a Helm-type Application may commit a symlink which points to an out-of-bounds file. If the target file is a valid YAML file, the attacker can read the contents of that file.
Sensitive files which could be leaked include manifest files from other Applications' source repositories (potentially decrypted files, if you are using a decryption plugin) or any YAML-formatted secrets which have been mounted as
GHSA
Symlink following allows leaking out-of-bounds YAML files from Argo CD repo-server
ghsa·2022-06-21
CVE-2022-31036 [MEDIUM] CWE-20 Symlink following allows leaking out-of-bounds YAML files from Argo CD repo-server
Symlink following allows leaking out-of-bounds YAML files from Argo CD repo-server
### Impact
All unpatched versions of Argo CD starting with v1.3.0 are vulnerable to a symlink following bug allowing a malicious user with repository write access to leak sensitive YAML files from Argo CD's repo-server.
A malicious Argo CD user with write access for a repository which is (or may be) used in a Helm-type Application may commit a symlink which points to an out-of-bounds file. If the target file is a valid YAML file, the attacker can read the contents of that file.
Sensitive files which could be leaked include manifest files from other Applications' source repositories (potentially decrypted files, if you are using a decryption plugin) or any YAML-formatted secrets which have been mounted as
Red Hat
argocd: vulnerable to a symlink following bug allowing a malicious user with repository write access
vendor_redhat·2022-06-15·CVSS 4.3
CVE-2022-31036 [MEDIUM] CWE-20 argocd: vulnerable to a symlink following bug allowing a malicious user with repository write access
argocd: vulnerable to a symlink following bug allowing a malicious user with repository write access
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of Argo CD starting with v1.3.0 are vulnerable to a symlink following bug allowing a malicious user with repository write access to leak sensitive YAML files from Argo CD's repo-server. A malicious Argo CD user with write access for a repository which is (or may be) used in a Helm-type Application may commit a symlink which points to an out-of-bounds file. If the target file is a valid YAML file, the attacker can read the contents of that file. Sensitive files which could be leaked include manifest files from other Applications' source repositories (potentially decrypted files, if you are using a decrypt
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/argoproj/argo-cd/commit/04c305396458508a31d03d44afea07b1c620d7cdhttps://github.com/argoproj/argo-cd/security/advisories/GHSA-q4w5-4gq2-98vmhttps://github.com/argoproj/argo-cd/commit/04c305396458508a31d03d44afea07b1c620d7cdhttps://github.com/argoproj/argo-cd/security/advisories/GHSA-q4w5-4gq2-98vm
2022-06-27
Published