SB2024041578 - Improper access control in Argo CD

Description

This security bulletin contains information about 1 security vulnerability.

1) Improper access control (CVE-ID: CVE-2024-31990)

The vulnerability allows a remote user to modify application resources outside intended project source namespace restrictions.

The vulnerability exists due to improper access control in the Argo CD API server when handling application updates and UI operations for an invalid Application. A remote user can change an Application's project assignment and then use the UI to edit a resource to modify application resources outside intended project source namespace restrictions.

Exploitation requires an Application to be created in one project and later reassigned to another project through kubectl or GitOps-managed changes.

Remediation

Install update from vendor's website.

References

• https://github.com/argoproj/argo-cd/security/advisories/GHSA-2gvw-w6fj-7m3c
• https://github.com/advisories/GHSA-2gvw-w6fj-7m3c