CVE-2024-31990: Argo CD's API server does not enforce project sourceNamespaces
I can convince the UI to let me do things with an invalid Application.
- Admin gives me
p, michael, applications, *, demo/*, allow, wheredemocan just deploy to thedemonamespace - Admin gives me AppProject
devwhich reconciles from nsdev-apps - Admin gives me
p, michael, applications, sync, dev/*, allow, i.e. no updating via the UI allowed, gitops-only - I create an Application called
pwnindev-appswith project dev and sync the app with sources from git - I change the Application’s project to demo via kubectl or gitops (whichever mechanism my admins have given me, because it should be safe)
- I use the UI to edit the resource which should only be mutable via gitops
References
- github.com/advisories/GHSA-2gvw-w6fj-7m3c
- github.com/argoproj/argo-cd
- github.com/argoproj/argo-cd/commit/c514105af739eebedb9dbe89d8a6dd8dfc30bb2c
- github.com/argoproj/argo-cd/commit/c5a252c4cc260e240e2074794aedb861d07e9ca5
- github.com/argoproj/argo-cd/commit/e0ff56d89fbd7d066e9c862b30337f6520f13f17
- github.com/argoproj/argo-cd/security/advisories/GHSA-2gvw-w6fj-7m3c
- nvd.nist.gov/vuln/detail/CVE-2024-31990
Code Behaviors & Features
Detect and mitigate CVE-2024-31990 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →