CVE-2024-41666: 
Argo CD vulnerability analysis and mitigation

CVE-2024-41666 affects Argo CD, a declarative GitOps continuous delivery tool for Kubernetes. The vulnerability was discovered in the Web-based terminal feature that allows users to get a shell inside a running pod. Starting from version 2.6.0, when administrators enable this function and grant permission to users with p, role:myrole, exec, create, */*, allow, users can continue performing operations in the container even after their permissions are revoked, as long as they keep the terminal view open. The vulnerability was disclosed on July 24, 2024, and has been patched in Argo CD versions 2.11.7, 2.10.16, and 2.9.21 (GitHub Advisory).

The vulnerability stems from improper handling of permission revocation in web terminal sessions. While previous fixes addressed token expiration and user revocation, they did not properly handle the revocation of specific permissions like p, role:myrole, exec, create, */*, allow. The vulnerability has been assigned a CVSS v3.1 base score of 6.5 MEDIUM (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) by NIST NVD, while GitHub assessed it as 4.7 MEDIUM (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L) (NVD).

The vulnerability can lead to unauthorized access to sensitive information within containers. Even after permission revocation, affected users can continue to perform operations in the container environment, potentially accessing confidential data they should no longer have access to (GitHub Advisory).

A proof-of-concept exploit has been demonstrated and documented. The exploit requires the Web-based Terminal feature to be enabled and the attacker to have initially been granted specific permissions. The attack can be executed by maintaining an open terminal session after permissions are revoked (GitHub Advisory).

The vulnerability has been patched in Argo CD versions 2.11.7, 2.10.16, and 2.9.21. Organizations are advised to upgrade to these or newer versions to address the vulnerability. The fix implements proper permission validation for each message, not just during the initial handshake (GitHub Advisory).