GitHub Advisory: Argo CD Command Injection via SSH Git Repository Proxy (GHSA-j5cw-g6p4-7hch)

Vulnerability Overview Vulnerability Name: Command injection via a repository proxy URL on SSH Git repositories CVE ID: GHSA-j5cw-g6p4-7hch Publication Date: January 9, 2024 Severity: High (8.8 / 10) Scope Affected Versions: - : >= 2.11.0 - : >= 3.0.0, < 3.3.15 Vulnerability Description: - Argo CD executes a shell command on the repository server when cloning or fetching SSH Git repositories that have a proxy URL. - The hostname and port from the proxy URL are copied into the SSH ProxyCommand. If the hostname contains shell metacharacters, these characters can escape the command and be executed on the repository server. - This vulnerability affects all currently supported versions starting from v2.11.0. Versions v2.10.29 and earlier are not affected. - The vulnerability was introduced in commit 9b27aeb1a4fb15d11a0f1cad65dea1fdf60205 (#15864) and first released in v2.11.0. Remediation Released Patched Versions: - v3.6.0-rc2 - v3.5.4 - v3.4.10 - v3.3.15 Remediation Measures: - The patch prevents passing proxy hosts and ports through the shell. - Argo CD 2.x and versions 3.0 to 3.2 are no longer supported and will not receive patches. Upgrading to a patched version 3.3 or newer is recommended. Workarounds Workarounds: - There is no configuration option to retain SSH repository proxies while removing the shell command. - Do not grant repository creation or update permissions to untrusted users, including project-level repository permissions. - Do not set a proxy on SSH repositories or on credential templates that match SSH repositories. The proxy field is documented in the credential templates for configuring repositories. - This command is not used for HTTPS Git repositories using HTTP proxies. Review existing repository and credential template keys to prevent unintended proxy values. References Commit introducing the vulnerability: 9b27aeb1a4fb15d11a0f1cad65dea1fdf60205 (#15864), first released in v2.11.0 Credential templates for configuring repositories: Link Additional Information Open an issue in the Argo CD issue tracker or discussion forum. Join us in the Slack channel #argo-cd. Credits Thanks to the following individuals for responsibly disclosing this vulnerability: @kamil-sawicki, @yuvalelarat, @cherez0ff, @McCaulay, @gehan-psbc, @ria-labs-security, @parameter-ai-security, and @zwinder.

Goal Reached Thanks to every supporter — we hit 100%!

GitHub Advisory: Argo CD Command Injection via SSH Git Repository Proxy (GHSA-j5cw-g6p4-7hch)

More from this source