Dissecting the Discovery of the 0-Day Supply Chain Vulnerability in Argo CD
summary
Discovery shows CVE-2022-24348 lets a user-supplied Helm valueFiles entry bypass Argo CD’s path checks because Go’s parseRequestURI treats crafted inputs as URIs not filesystem paths, skipping directory-cleaning and allowing traversal into the repo server’s deterministic file layout to read other apps’ YAML/JSON secrets. Proof-of-concept uses malicious chart values and repo enumeration via verbose errors, and the fix ships in Argo CD 2.2.24; long-term mitigations include file-level permissions and tighter repo isolation.
AI-written summary · about
chapters (14)
- 0:00Introduction
- 1:02Agenda
- 2:10Basics
- 4:35Why
- 7:37Research Routine
- 12:22Parsing
- 15:28Developer Thread
- 16:25Security Checks
- 20:45Read the Documentation
- 22:47Extended Attacks
- 24:57Remediation
- 25:47File Permissions
- 26:33Summary Conclusion
- 27:04Special Thanks
related talks
31mAttacking Argo CD with Argo CD (and then Defending)
23mA Practical Guide to ArgoCD Security Gating
34mHow the Argo Project Transitioned From Security Aware To Security First
24mThe Hidden Dangers of Defaults: Securing Multi-Tenant Argo CD Install...
26mThreat Model Report: Security Considerations for Hardening D...
25mArgo CD Ephemeral Access in Action: Lessons Learned While Runnin...
26mThreat Model Report: Security Considerations for Hardening D...
05mProject Lightning Talk: Argo CD at Scale: 5 Features You Should Not Miss!