CVE-2023-23947: 
Argo CD vulnerability analysis and mitigation

Argo CD, a declarative GitOps continuous delivery tool for Kubernetes, was found to contain a critical security vulnerability (CVE-2023-23947) with a CVSS score of 9.1. The vulnerability affects all Argo CD versions from 2.3.0-rc1 through 2.3.16, 2.4.22, 2.5.10, and 2.6.1. This security flaw was introduced when Argo CD began storing cluster access configurations as Kubernetes Secrets (GitHub Advisory, Security Online).

The vulnerability is an improper authorization bug that allows users with the ability to update at least one cluster secret to update any cluster secret. To exploit this vulnerability, an attacker must meet several prerequisites: they must know the server URL for the target cluster secret, be authenticated with the Argo CD API server, and have authorization to update at least one non-project-scoped cluster. The vulnerability received a Critical severity rating with a CVSS v3.1 score of 9.1, indicating its high impact potential (GitHub Advisory).

The exploitation of this vulnerability could lead to privilege escalation, potentially allowing attackers to control Kubernetes resources. Attackers could also disrupt Argo CD functionality by preventing connections to external clusters. Additionally, attackers could modify cluster connection parameters, potentially enabling malicious-in-the-middle (MITM) attacks by disabling certificate verification, or achieve denial-of-service by setting invalid configurations (GitHub Advisory).

The vulnerability has been patched in Argo CD versions 2.6.2, 2.5.11, 2.4.23, and 2.3.17. For users unable to upgrade immediately, two workarounds are available: 1) Modify RBAC configuration to completely revoke all clusters, update access, or 2) Use the destinations and clusterResourceWhitelist fields in AppProjects to apply similar restrictions as the namespaces and clusterResources fields. Users should also ensure strict RBAC restrictions and limit projects update access to Argo CD administrators only (GitHub Advisory).