CVE-2023-46402

Отчет

This vulnerability in the git-urls package requires an attacker to provide malicious input to the git URL parsing function. In Red Hat OpenShift GitOps deployments, git repository URLs are configured exclusively by platform administrators through Application and ApplicationSet custom resources. End users do not have the ability to inject arbitrary git URLs through any exposed API. The attack surface is limited to trusted administrators who already have elevated cluster privileges.

Меры по смягчению последствий

To reduce exposure to this vulnerability in OpenShift GitOps:

1. Limit Application and ApplicationSet creation to platform administrators using RBAC.
2. Configure ArgoCD AppProjects with explicit sourceRepos allowlists. Avoid wildcard (*) sources.
3. Use ApplicationSet resource policies to prevent user-provided git URLs from being templated into Applications.
4. In order to Audit which Git repositories are used by GitOps and Validate no untrusted repos are configured use: oc get applications -A -o jsonpath='{range .items[*]}{.metadata.name}{"\t"}{.spec.source.repoURL}{"\n"}{end}'