Major Vulnerability Found in Argo CD

Security researchers at Apiiro have identified a substantial application offer chain zero-day vulnerability in the preferred open up-source continuous delivery platform, Argo CD.

Made use of by countless numbers of businesses globally, Argo CD is a tool that reads setting configurations (penned as a helm chart, kustomize information, jsonnet or plain YAML data files) from git repositories and applies it Kubernetes namespaces. The platform can handle the execution and monitoring of software deployment post-integration.

The flaw (CVE-2022-24348) allows attackers obtain and exfiltrate delicate facts these types of as passwords and API keys.

“A -working day vulnerability, discovered by Apiiro’s Security Research crew, enables destructive actors to load a Kubernetes Helm Chart YAML file to the vulnerability and ‘hop’ from their application ecosystem to other applications’ knowledge exterior of the user’s scope,” wrote scientists.

Exploitation of the flaw can direct to privilege escalation, sensitive details disclosure, lateral movement attacks and additional.

The attack starts with the threat actor developing a malicious Kubernetes Helm Chart-a YAML file that embeds distinct fields to type a declaration of sources and configurations necessary in get for deploying an software.

Utilizing the Helm Chart, the attacker builds a dummy configuration to exploit a parsing confusion vulnerability to entry limited information.

Ultimately, the attacker extracts delicate knowledge these as API keys and passwords that can be leveraged to have up comply with-up attacks and aid lateral movement inside of the victim’s network. 

Apiiro noted the attack to Argo CD on January 30 2022. After talking about the vulnerability’s extent and impact, the vendor developed a patch to repair the challenge. Advisories and the patch have been unveiled on Thursday. 

Apiiro’s exploration group praised Argo CD’s incident response and “professional dealing with of the situation.”

“We are looking at a lot more superior persistent threats that leverage zero day and acknowledged, unmitigated vulnerabilities in program supply chain computer software such as Argo CD,” commented Yaniv Bar-Dayan, CEO and co-founder at Vulcan Cyber.

He added: “For decades, acknowledged, unmitigated vulnerabilities have contributed additional than any other factor to mounting cyber risk. But hackers are normally searching for the most-powerful path of least resistance to achieve their objectives.”

Some components of this article are sourced from:
www.infosecurity-journal.com