CVE-2022-24904: 
Argo CD vulnerability analysis and mitigation

Argo CD, a declarative GitOps continuous delivery tool for Kubernetes, was found to contain a symlink following vulnerability (CVE-2022-24904) affecting versions 0.7.0 through 2.1.14, 2.2.8, and 2.3.3. The vulnerability was discovered in May 2022 and allows malicious users with repository write access to potentially leak sensitive files from Argo CD's repo-server (GitHub Advisory).

The vulnerability stems from a symlink following bug where a malicious user with write access to a repository used in a directory-type Application can commit a symlink pointing to an out-of-bounds file. If the target file is a valid JSON or YAML manifest file and the resource is allowed in the Application, the attacker can read the contents of that manifest file. In versions prior to 2.3.2, 2.2.8, and 2.1.14, the attacker could read file contents even if the resource was not allowed in the Application. The vulnerability has been assigned a CVSS v3 base score of 4.3 (Moderate severity) with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N (GitHub Advisory).

The vulnerability could lead to the exposure of sensitive information, including manifest files from other Applications' source repositories (potentially including decrypted files when using a decryption plugin) or any JSON-formatted secrets mounted as files on the repo-server. If the target file is valid JSON but not a manifest file, the attacker may read the entire contents, while non-JSON/YAML files may have partial content exposure (GitHub Advisory).

The vulnerability has been patched in Argo CD versions 2.3.4, 2.2.9, and 2.1.15. For users of version ≥2.3.0 without Jsonnet/directory-type Applications, it's recommended to disable the Jsonnet/directory config management tool. Additional mitigations include avoiding mounting JSON-formatted secrets as files on the repo-server, limiting push access to manifest repositories, restricting user access to necessary Projects, and limiting resource kinds and destinations allowed for Projects (GitHub Advisory).