Attacking Argo CD with Argo CD (and then Defending)
summary
Shows a concrete escalation: an attacker uses Argo CD to modify the argo cd rbac cm (via kubectl apply or argo cd app patch) and fully takeover by changing RBAC CSV rules; a discovered CVE climbs from ~7.x to 9.9 and is fixed within nine days. Demonstrates exploitable commands like argo cd app sync --local override and repo-server symlink traversal, then builds defenses: restrict Git sources with glob patterns, remove update/create/delete/override rights, lock project destinations, and notes new applications in any namespace and repo-server symlink defaults in 2.5.
AI-written summary · about
chapters (16)
- 0:00Start
- 1:21Basic Argo CD structure
- 2:43What a bootstrapped instance looks like
- 3:41Why the RBAC ConfigMap matters
- 4:56What the attack looks like
- 6:39An extreme example of the attack
- 8:23Defenses
- 10:36Attack: change the App's source repo
- 11:08Defense option 1: restrict Project source
- 12:20Defense option 2: restrict RBAC
- 13:34Attack: override the App's manifests
- 14:52Defense: disallow 'override' action
- 15:18Summary: git-based defense
- 16:27Initial setup
- 16:56Attack: take over RBAC
- 17:14Defense: restrict project destinations
related talks
28mDissecting the Discovery of the 0-Day Supply Chain Vulnerability in Argo CD
24mThe Hidden Dangers of Defaults: Securing Multi-Tenant Argo CD Install...
23mA Practical Guide to ArgoCD Security Gating
26mThreat Model Report: Security Considerations for Hardening D...
25mArgo CD Ephemeral Access in Action: Lessons Learned While Runnin...
08mArgo CD Update
22mTaming the Chaos: Fine-Grained RBAC in Argo CD for Incident Avoidance
42mLet's Learn About ArgoCD