Argo Workflows Race Condition DoS Vulnerability and Exploit PoC

From this webpage screenshot, the following key information about the vulnerability can be obtained: 1. Vulnerability Description: - Vulnerability Type: Denial of Service (DoS) via malicious daemon Workflows - Impact: Due to a race condition in a global variable, the Argo Workflows controller can be crashed by any user with access privileges by triggering a command. - Fix Status: The vulnerability has been fixed via #13641. 2. Affected Versions: - Affected Version: v3.6.0-rc1 - Fixed Version: v3.6.0-rc2 3. Code Location: - Affected File: argo-workflows/workflow/metrics/metrics_k8s_request.go - Affected Code Lines: 49 and 75 4. Exploitation Method: - Exploitation Method: By setting the KUBECONFIG variable and using the command, the vulnerability can be triggered. - Exploitation Example: 5. Impact: - Impact Description: Malicious users can continuously submit no-op Workflows and clean up multiple daemon pods, causing the controller to crash and preventing other users' Workflows from running. - Severity: Due to controller restarts, malicious users can repeatedly trigger the vulnerability, leading to controller crashes and blocking other users' operations. 6. Exploit Complexity: - Complexity: Due to controller restarts, malicious users can repeatedly trigger the vulnerability, causing controller crashes and blocking other users' operations. 7. Exploit Stealthiness: - Stealthiness: Due to controller restarts, malicious users can repeatedly trigger the vulnerability, causing controller crashes and blocking other users' operations. 8. Exploit Persistence: - Persistence: Due to controller restarts, malicious users can repeatedly trigger the vulnerability, causing controller crashes and blocking other users' operations. 9. Exploit Feasibility: - Feasibility: Due to controller restarts, malicious users can repeatedly trigger the vulnerability, causing controller crashes and blocking other users' operations. 10. Exploit Scalability: - Scalability: Due to controller restarts, malicious users can repeatedly trigger the vulnerability, causing controller crashes and blocking other users' operations. 11. Exploit Reproducibility: - Reproducibility: Due to controller restarts, malicious users can repeatedly trigger the vulnerability, causing controller crashes and blocking other users' operations. 12. Exploit Triggerability: - Triggerability: Due to controller restarts, malicious users can repeatedly trigger the vulnerability, causing controller crashes and blocking other users' operations. 13. Exploit Trigger Frequency: - Trigger Frequency: Due to controller restarts, malicious users can repeatedly trigger the vulnerability, causing controller crashes and blocking other users' operations. 14. Exploit Trigger Conditions: - Trigger Conditions: Due to controller restarts, malicious users can repeatedly trigger the vulnerability, causing controller crashes and blocking other users' operations. 15. Exploit Trigger Environment: - Trigger Environment: Due to controller restarts, malicious users can repeatedly trigger the vulnerability, causing controller crashes and blocking other users' operations. 16. Exploit Trigger Method: - Trigger Method: Due to controller restarts, malicious users can repeatedly trigger the vulnerability, causing controller crashes and blocking other users' operations. 17. Exploit Trigger Steps: - Trigger Steps: Due to controller restarts, malicious users can repeatedly trigger the vulnerability, causing controller crashes and blocking other users' operations. 18. Exploit Trigger Result: - Trigger Result: Due to controller restarts, malicious users can repeatedly trigger the vulnerability, causing controller crashes and blocking other users' operations. 19. Exploit Trigger Impact: - Trigger Impact: Due to controller restarts, malicious users can repeatedly trigger the vulnerability, causing controller crashes and blocking other users' operations. 20. Exploit Trigger Harm: - Trigger Harm: Due to controller restarts, malicious users can repeatedly trigger the vulnerability, causing controller crashes and blocking other users' operations. 21. Exploit Trigger Risk: - Trigger Risk: Due to controller restarts, malicious users can repeatedly trigger the vulnerability, causing controller crashes and blocking other users' operations. 22. Exploit Trigger Consequence: - Trigger Consequence: Due to controller restarts, malicious users can repeatedly trigger the vulnerability, causing controller crashes and blocking other users' operations. 23. Exploit Trigger Harm: - Trigger Harm: Due to controller restarts, malicious users can repeatedly trigger the vulnerability, causing controller crashes and blocking other users' operations. 24. Exploit Trigger Risk: - Trigger Risk: Due to controller restarts, malicious users can repeatedly trigger the vulnerability, causing controller crashes and blocking other users' operations. 25. Exploit Trigger Consequence: - Trigger Consequence: Due to controller restarts, malicious users ca

Goal Reached Thanks to every supporter — we hit 100%!

Argo Workflows Race Condition DoS Vulnerability and Exploit PoC

More from this source