CVE-2024-28175: 
Argo CD vulnerability analysis and mitigation

CVE-2024-28175 is a critical cross-site scripting (XSS) vulnerability discovered in Argo CD, a declarative GitOps continuous delivery tool for Kubernetes. The vulnerability affects all unpatched versions starting from v1.0.0 and stems from improper URL protocols filtering of links specified in the link.argocd.argoproj.io annotations within the application summary component. The vulnerability was disclosed on March 13, 2024, and was assigned a CVSS score of 9.0 (Critical) (GitHub Advisory).

The vulnerability exists due to insufficient validation of URL protocols in the application summary component of Argo CD. When malicious users inject javascript: links in the UI through the link.argocd.argoproj.io annotations, these links can execute arbitrary JavaScript code when clicked by other users. The executed code runs with the victim's permissions, which could extend up to full administrative privileges. The vulnerability has been assigned CWE-79 (Improper Neutralization of Input During Web Page Generation) and received a CVSS v3.1 base score of 9.0 with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H (NVD, GitHub Advisory).

The vulnerability allows attackers to perform arbitrary actions on behalf of victims via the API, including creating, modifying, and deleting Kubernetes resources. When exploited, the attacker can execute code with the permissions of the victim user, potentially gaining full administrative access to the system. This could lead to unauthorized access to confidential information within deployments and potentially serve as a launchpad for further attacks (Security Online).

The vulnerability requires an attacker to have permissions to edit Kubernetes resource manifests in Argo CD. The exploit involves creating malicious external links through annotations, which when clicked by victims, execute the attacker's JavaScript code. The link's title can be user-configurable, making it difficult to identify malicious links even by hovering over them (GitHub Advisory).

The vulnerability has been patched in Argo CD versions v2.10.3, v2.9.8, and v2.8.12. For organizations unable to upgrade immediately, the recommended workaround is to implement a Kubernetes admission controller that rejects resources with annotations starting with link.argocd.argoproj.io or those using improper URL protocols. This validation must be applied across all ArgoCD-managed clusters. Users are advised to avoid clicking external links presented in the UI and carefully limit permissions for editing Kubernetes resource manifests through RBAC configuration (GitHub Advisory).

The vulnerability was discovered and reported by security researcher RyotaK (@Ry0taK). The Argo CD team responded promptly by releasing patches and providing detailed mitigation guidance (GitHub Advisory).