Security News > 2022 > February > Argo CD Security Bug Opens Kubernetes Cloud Apps to Attackers

A high-severity security vulnerability in Argo CD can enable attackers to access targets' application-development environments, paving the way for stealing passwords, API keys, tokens and other sensitive information.

Argo CD is a continuous-delivery platform deployed as a Kubernetes controller in the cloud, and it's used to deploy applications, then continuously monitor them in real time as they run.

The bug is a path-traversal issue, according to Apiiro's security-research team, which occurs when adversaries are able to access files and directories that are stored outside their permissioned purview.

Attackers can exploit the bug by loading a malicious Kubernetes Helm Chart YAML file into the Argo CD system, then using it to "Hop" from their own application ecosystem to access other applications' data, researchers said.

The file includes "The metadata and information needed to deploy the appropriate Kubernetes configuration, and the ability to dynamically update the cloud configuration as the manifest is being modified."

Argo CD's anti-path-traversal mechanism is handled by single file in the source code, according to the analysis.

News URL

https://threatpost.com/argo-cd-security-bug-kubernetes-cloud-apps/178239/