Description
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. It has been discovered that an unprivileged pod in a different namespace on the same cluster could connect to the Redis server on port 6379. Despite having installed the latest version of the VPC CNI plugin on the EKS cluster, it requires manual enablement through configuration to enforce network policies. This raises concerns that many clients might unknowingly have open access to their Redis servers. This vulnerability could lead to Privilege Escalation to the level of cluster controller, or to information leakage, affecting anyone who does not have strict access controls on their Redis instance. This issue has been patched in version(s) 2.8.19, 2.9.15 and 2.10.10.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| argoproj | argo-cd | < 2.8.19, >= 2.9.0-rc1, < 2.9.15, >= 2.10.0-rc1, < 2.10.10, >= 2.11.0-rc1, < 2.11.1, <= 1.8.7 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
vt0x78/CVE-2024-31989 ★ 3 · Jul 17, 2024
Exploit for CVE-2024-31989.
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/argoproj/argo-cd | <= 1.8.7 | — | GHSA-9766-5277-j5hr |
| Go | github.com/argoproj/argo-cd | all versions | — | GO-2024-2877 |
| Go | github.com/argoproj/argo-cd/v2 | < 2.8.19 | 2.8.19 | GHSA-9766-5277-j5hr |
| Go | github.com/argoproj/argo-cd/v2 | >= 2.9.0-rc1, < 2.9.15 | 2.9.15 | GHSA-9766-5277-j5hr |
| Go | github.com/argoproj/argo-cd/v2 | >= 2.10.0-rc1, < 2.10.10 | 2.10.10 | GHSA-9766-5277-j5hr |
| Go | github.com/argoproj/argo-cd/v2 | >= 2.11.0-rc1, < 2.11.1 | 2.11.1 | GHSA-9766-5277-j5hr |
| Go | github.com/argoproj/argo-cd/v2 | < 2.8.19 · >= 2.9.0-rc1, < 2.9.15 · >= 2.10.0-rc1, < 2.10.10 · >= 2.11.0-rc1, < 2.11.1 | 2.8.19, 2.9.15, 2.10.10, 2.11.1 | GO-2024-2877 |
Advisories 1
- WID-SEC-2024-1239 Red Hat OpenShift GitOps: Schwachstelle ermöglicht Privilegieneskalation BSI CERT-Bund (WID) · May 30, 2024
References
- https://github.com/argoproj/argo-cd/security/advisories/GHSA-9766-5277-j5hr
- https://github.com/argoproj/argo-cd/commit/2de0ceade243039c120c28374016c04ff9590d1d
- https://github.com/argoproj/argo-cd/commit/35a7d6c7fa1534aceba763d6a68697f36c12e678
- https://github.com/argoproj/argo-cd/commit/4e2fe302c3352a0012ecbe7f03476b0e07f7fc6c
- https://github.com/argoproj/argo-cd/commit/53570cbd143bced49d4376d6e31bd9c7bd2659ff
- https://github.com/argoproj/argo-cd/commit/6ef7b62a0f67e74b4aac2aee31c98ae49dd95d12
- https://github.com/argoproj/argo-cd/commit/9552034a80070a93a161bfa330359585f3b85f07
- https://github.com/argoproj/argo-cd/commit/bdd889d43969ba738ddd15e1f674d27964048994
- https://github.com/argoproj/argo-cd/commit/f1a449e83ee73f8f14d441563b6a31b504f8d8b0