Описание
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From versions 3.2.0 to before 3.2.11 and 3.3.0 to before 3.3.9, there is a missing authorization and data-masking gap in Argo CD's ServerSideDiff endpoint that allows an attacker with read-only access to extract plaintext Kubernetes Secret data from etcd via the Kubernetes API server's Server-Side Apply dry-run mechanism. This issue has been patched in versions 3.2.11 and 3.3.9.
Ссылки
- ExploitVendor Advisory
- ExploitVendor Advisory
Уязвимые конфигурации
Одно из
EPSS
9.6 Critical
CVSS3
7.7 High
CVSS3
Дефекты
Связанные уязвимости
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From versions 3.2.0 to before 3.2.11 and 3.3.0 to before 3.3.9, there is a missing authorization and data-masking gap in Argo CD's ServerSideDiff endpoint that allows an attacker with read-only access to extract plaintext Kubernetes Secret data from etcd via the Kubernetes API server's Server-Side Apply dry-run mechanism. This issue has been patched in versions 3.2.11 and 3.3.9.
ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction
Уязвимость декларативного инструмента непрерывной доставки GitOps для Kubernetes Argo CD, связанная с неправильным межграничным удалением критичных данных, позволяющая нарушителю раскрыть защищаемую информацию
EPSS
9.6 Critical
CVSS3
7.7 High
CVSS3