CVE-2024-22424: 
Argo CD vulnerability analysis and mitigation

The Argo CD API prior to versions 2.10-rc2, 2.9.4, 2.8.8, and 2.7.16 was identified as vulnerable to a cross-server request forgery (CSRF) attack (CVE-2024-22424). The vulnerability was discovered and disclosed in January 2024, affecting all versions from 0.1.0 through 2.10.0-rc1, v2.9.3, v2.8.7, and v2.7.15 of the Argo CD continuous delivery tool for Kubernetes (GitHub Advisory).

The vulnerability exists when an attacker has the ability to write HTML to a page on the same parent domain as Argo CD. While Argo CD implements a 'Lax' SameSite cookie policy to prevent CSRF attacks from external domains, this protection is ineffective when the attacker controls content on a subdomain of the parent domain. The vulnerability bypasses browser CORS protections by exploiting Argo CD's lack of content type header validation, allowing attackers to set non-sensitive content types like 'text/plain' while still sending JSON content (GitHub Advisory). The vulnerability has been assigned a CVSS v3.1 base score of 8.3 (High) with vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H (NVD).

An attacker could exploit this vulnerability by tricking an authenticated Argo CD user into loading a malicious web page that executes unauthorized API calls on behalf of the victim. This could lead to various malicious actions, including but not limited to creating applications that run malicious code. The attack is particularly effective in environments where Argo CD is hosted on internal subdomains, as the SameSite cookie protection becomes ineffective (GitHub Advisory).

The vulnerability has been patched in Argo CD versions 2.10-rc2, 2.9.4, 2.8.8, and 2.7.16. The patch implements a breaking API change that requires non-GET requests to specify 'application/json' as their Content-Type. While the accepted content types list is configurable, disabling the content type check is discouraged. There are no known workarounds for this vulnerability, and users are strongly advised to upgrade to a patched version (GitHub Advisory).

The Argo CD team acknowledged the contribution of An Trinh from Calif for responsibly reporting the issue and assisting with the patch review. The vulnerability was initially reported through a GitHub issue and was subsequently addressed through a coordinated disclosure process (GitHub Advisory).