CVE-2024-31989: 
Argo CD vulnerability analysis and mitigation

CVE-2024-31989 affects Argo CD, a declarative GitOps continuous delivery tool for Kubernetes. The vulnerability was discovered in May 2024 and involves an unprivileged pod in a different namespace on the same cluster being able to connect to the Redis server on port 6379. Despite having the latest version of the VPC CNI plugin installed on EKS clusters, manual configuration is required to enforce network policies, potentially leaving many clients with unprotected Redis servers. The vulnerability affects all versions until 2.11.0, 2.10.9, 2.9.14, and 2.8.18, with patches available in versions 2.11.1, 2.10.10, 2.9.15, and 2.8.19 (GitHub Advisory).

The vulnerability stems from the Redis database server not being password-protected by default. The issue allows attackers to modify the 'mfst' (manifest) key in Redis, potentially causing Argo CD to execute arbitrary deployments. The vulnerability exploits the fact that while cache entries are protected by a 'cacheEntryHash', this hash doesn't use a private key for signing, making it possible to generate new FNV64a hashes matching modified manifest values. The CVSS score is 9.1 (Critical), with the vector string CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H (GitHub Advisory).

The vulnerability can lead to two major security impacts: 1) Privilege Escalation to cluster controller level, allowing attackers to take complete control over the Kubernetes cluster, and 2) Information Leakage through manipulation of the 'app|resources-tree' key, enabling unauthorized access to sensitive Kubernetes resources. This affects any organization that doesn't have strict access controls on their Redis instance (GitHub Advisory).

The vulnerability has been patched in Argo CD versions 2.11.1, 2.10.10, 2.9.15, and 2.8.19. Organizations should upgrade to these patched versions immediately. Additionally, it's recommended to enable network policy enforcement through proper configuration of the VPC CNI plugin and implement strict access controls on the Redis instance. The Redis password is stored in Kubernetes secret 'argocd-redis' with key 'auth' in the namespace where Argo CD is installed (NVD).