Skip to content

x/vulndb: potential Go vuln in github.com/argoproj/argo-cd: GHSA-q9hr-j4rf-8fjc #1520

New issue
New issue
Closed
Closed
x/vulndb: potential Go vuln in github.com/argoproj/argo-cd: GHSA-q9hr-j4rf-8fjc#1520
Assignees
maceonthompson
Labels
excluded: NOT_IMPORTABLEThis vulnerability only exists in a binary and is not importable.
@GoVulnBot

Description

@GoVulnBot
GoVulnBot
opened on Jan 25, 2023

In GitHub Security Advisory GHSA-q9hr-j4rf-8fjc, there is a vulnerability in the following Go packages or modules:

Unit Fixed Vulnerable Ranges
github.com/argoproj/argo-cd 2.6.0-rc5 >= 2.6.0-rc1, < 2.6.0-rc5

Cross references:

See doc/triage.md for instructions on how to triage this report.

modules:
  - module: github.com/argoproj/argo-cd
    versions:
      - introduced: 2.6.0-rc1
        fixed: 2.6.0-rc5
    packages:
      - package: github.com/argoproj/argo-cd
  - module: github.com/argoproj/argo-cd
    versions:
      - introduced: 2.5.0
        fixed: 2.5.8
    packages:
      - package: github.com/argoproj/argo-cd
  - module: github.com/argoproj/argo-cd
    versions:
      - introduced: 2.4.0
        fixed: 2.4.20
    packages:
      - package: github.com/argoproj/argo-cd
  - module: github.com/argoproj/argo-cd
    versions:
      - introduced: 1.8.2
        fixed: 2.3.14
    packages:
      - package: github.com/argoproj/argo-cd
description: "### Impact\n\nAll versions of Argo CD starting with v1.8.2 are vulnerable
    to an improper authorization bug causing the API to accept certain invalid tokens.\n\nOIDC
    providers include an `aud` (audience) claim in signed tokens. The value of that
    claim specifies the intended audience(s) of the token (i.e. the service or services
    which are meant to accept the token). Argo CD _does_ validate that the token was
    signed by Argo CD's configured OIDC provider. But Argo CD _does not_ validate
    the audience claim, so it will accept tokens that are not intended for Argo CD.\n\nIf
    Argo CD's configured OIDC provider also serves other audiences (for example, a
    file storage service), then Argo CD will accept a token intended for one of those
    other audiences. Argo CD will grant the user privileges based on the token's `groups`
    claim, even though those groups were not intended to be used by Argo CD.\n\nThis
    bug also increases the blast radius of a stolen token. If an attacker steals a
    valid token for a different audience, they can use it to access Argo CD.\n\n###
    Patches\n\nA patch for this vulnerability has been released in the following Argo
    CD versions:\n\n* v2.6.0-rc5\n* v2.5.8\n* v2.4.20\n* v2.3.14\n\nThe patch introduces
    a new `allowedAudiences` to the OIDC config block. By default, the client ID is
    the only allowed audience. Users who _want_ Argo CD to accept tokens intended
    for a different audience may use `allowedAudiences` to specify those audiences.\n\n```yaml\napiVersion:
    v1\nkind: ConfigMap\nmetadata:\n  name: argocd-cm\ndata:\n  oidc.config: |\n    name:
    Example\n    allowedAudiences:\n    - audience-1\n    - audience-2\n    - argocd-client-id
    \ # If `allowedAudiences` is non-empty, Argo CD's client ID must be explicitly
    added if you want to allow it.\n```\n\nEven though [the OIDC spec requires the
    audience claim](https://openid.net/specs/openid-connect-core-1_0.html#IDToken),
    some tokens may not include it. To avoid a breaking change in a patch release,
    versions < 2.6.0 of Argo CD will skip the audience claim check for tokens that
    have no audience. In versions >= 2.6.0, Argo CD will reject all tokens which do
    not have an audience claim. Users can opt into the old behavior by setting an
    option:\n\n```yaml\napiVersion: v1\nkind: ConfigMap\nmetadata:\n  name: argocd-cm\ndata:\n
    \ oidc.config: |\n    name: Example\n    skipAudienceCheckWhenTokenHasNoAudience:
    true\n```\n\n### Workarounds\n\nThere is no workaround besides upgrading.\n\n###
    Credits \n\nThe Argo CD team would like to express their gratitude to Vladimir
    Pouzanov (@farcaller) from Indeed, who discovered the issue, reported it confidentially
    according to our [guidelines](https://github.com/argoproj/argo-cd/blob/master/SECURITY.md#reporting-a-vulnerability),
    and actively worked with the project to provide a remedy. Many thanks to Vladimir!\n\n###
    References\n\n* [How to configure OIDC in Argo CD](https://argo-cd.readthedocs.io/en/latest/operator-manual/user-management/#existing-oidc-provider)\n*
    [OIDC spec section discussing the audience claim](https://openid.net/specs/openid-connect-core-1_0.html#IDToken)\n*
    [JWT spec section discussing the audience claim](https://www.rfc-editor.org/rfc/rfc7519#section-4.1.3)\n\n###
    For more information\n\n* Open an issue in [the Argo CD issue tracker](https://github.com/argoproj/argo-cd/issues)
    or [discussions](https://github.com/argoproj/argo-cd/discussions)\n* Join us on
    [Slack](https://argoproj.github.io/community/join-slack) in channel #argo-cd\n"
cves:
  - CVE-2023-22482
ghsas:
  - GHSA-q9hr-j4rf-8fjc

Metadata

Metadata

Assignees

Labels

excluded: NOT_IMPORTABLEThis vulnerability only exists in a binary and is not importable.

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions