{"id":"CVE-2023-40029","published":"2023-09-07T22:11:56Z","modified":"2024-09-26T18:22:28Z","title":"Cluster secret might leak in cluster details page in Argo CD","vendor":"argoproj","product":"argo-cd","tier":"tail","description":{"text":"Argo CD is a declarative continuous deployment for Kubernetes. Argo CD Cluster secrets might be managed declaratively using Argo CD / kubectl apply. As a result, the full secret body is stored in`kubectl.kubernetes.io/last-applied-configuration` annotation. pull request #7139 introduced the ability to manage cluster labels and annotations. Since clusters are stored as secrets it also exposes the `kubectl.kubernetes.io/last-applied-configuration` annotation which includes full secret body. In order to view the cluster annotations via the Argo CD API, the user must have `clusters, get` RBAC access. **Note:** In many cases, cluster secrets do not contain any actually-secret information. But sometimes, as in bearer-token auth, the contents might be very sensitive. The bug has been patched in versions 2.8.3, 2.7.14, and 2.6.15. Users are advised to upgrade. Users unable to upgrade should update/deploy cluster secret with `server-side-apply` flag which does not use or rely on `kubectl.kubernetes.io/last-applied-configuration` annotation. Note: annotation for existing secrets will require manual removal.\n\n","provenance":"source","from":"CVE.org"},"cvss":{"score":9.9,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.01196,"percentile":0.68044,"provenance":"source"},"cwes":[{"id":"CWE-200","name":"Exposure of Sensitive Information to an Unauthorized Actor"}],"references":[{"url":"https://github.com/argoproj/argo-cd/security/advisories/GHSA-fwr2-64vr-xv9m","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/argoproj/argo-cd/pull/7139","tags":["x_refsource_MISC"]},{"url":"https://github.com/argoproj/argo-cd/commit/4b2e5b06bff2ffd8ed1970654ddd8e55fc4a41c4","tags":["x_refsource_MISC"]}],"priority":{"score":25.5,"factors":[{"name":"EPSS percentile","points":13.61},{"name":"Public exploit code","points":5.0},{"name":"CVSS severity","points":6.93}]},"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2025-01-25","earliestUrl":"https://github.com/guobei233/CVE-2023-40029","repos":[{"name":"guobei233/CVE-2023-40029","url":"https://github.com/guobei233/CVE-2023-40029","stars":0,"created":"2025-01-25"}]},"first":{"date":"2025-01-25","source":"PoC-in-GitHub","url":"https://github.com/guobei233/CVE-2023-40029"},"provenance":"source"},"vendorSlug":"argoproj","affectedVersions":[{"vendor":"argoproj","product":"argo-cd","versions":[">= 2.2.0, < 2.6.15",">= 2.7.0, < 2.7.14",">= 2.8.0, < 2.8.3"]}],"affected":[{"ecosystem":"Go","package":"github.com/argoproj/argo-cd/v2","vulnerableRanges":[">=2.2.0, <2.6.15",">=2.7.0, <2.7.14",">=2.8.0, <2.8.3"],"patched":["2.6.15","2.7.14","2.8.3"],"from":["GHSA-fwr2-64vr-xv9m","GO-2023-2049"],"provenance":"source"},{"ecosystem":"Go","package":"github.com/argoproj/argo-cd","vulnerableRanges":["all versions"],"patched":[],"from":["GO-2023-2049"],"provenance":"source"}],"euvd":{"id":"EUVD-2023-2497","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-argoproj-argo-cd-cve-2023-40029","children":[{"from":"CVE-2023-40029","to":"CVE-2023-40584","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["cmd/argocd-repo-server/commands/argocd_repo_server.go","util/db/cluster.go","util/helm/client.go","util/helm/mocks/Client.go"],"commits":["https://github.com/argoproj/argo-cd/commit/4b2e5b06bff2ffd8ed1970654ddd8e55fc4a41c4","https://github.com/argoproj/argo-cd/commit/44e52c4ae76e6da1343bdd54e57a822d93549f28","https://github.com/argoproj/argo-cd/commit/b8f92c4ff226346624f43de3f25d81dac6386674","https://github.com/argoproj/argo-cd/commit/1391ba72149655e4884d357586d3201f15bc92dc"],"basis":"shared function","functions":["CleanChartCache","ExtractChart","GetRevisionChartDetails","NewCommand","SecretToCluster"]}]},{"from":"CVE-2023-40029","to":"CVE-2024-29893","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["cmd/argocd-repo-server/commands/argocd_repo_server.go","util/helm/client.go","util/helm/mocks/Client.go"],"commits":["https://github.com/argoproj/argo-cd/commit/4b2e5b06bff2ffd8ed1970654ddd8e55fc4a41c4","https://github.com/argoproj/argo-cd/commit/44e52c4ae76e6da1343bdd54e57a822d93549f28","https://github.com/argoproj/argo-cd/commit/14f681e3ee7c38731943b98f92277e88a3db109d","https://github.com/argoproj/argo-cd/commit/36b8a12a38f8d92d55bffc81deed44389bf6eb59"],"basis":"shared function","functions":["ExtractChart","NewCommand"]}]}],"packageHistory":[{"cve":"CVE-2023-23947","published":"2023-02-16","fixed":"2.6.2","kev":false},{"cve":"CVE-2022-41354","published":"2023-03-27","fixed":"2.6.7","kev":false},{"cve":"CVE-2023-40025","published":"2023-08-23","fixed":"2.8.1","kev":false,"link":{"from":"CVE-2023-40025","to":"CVE-2023-40029","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/argoproj/argo-cd/v2","fromFixed":"2.6.14","toFixed":"2.6.15","daysApart":15}]}},{"cve":"CVE-2023-40029","published":"2023-09-07","fixed":"2.8.3","kev":false},{"cve":"CVE-2023-40584","published":"2023-09-07","fixed":"2.8.3","kev":false},{"cve":"CVE-2024-22424","published":"2024-01-19","fixed":"2.10-rc2","kev":false},{"cve":"CVE-2023-50726","published":"2024-03-13","fixed":"2.10.3","kev":false}],"package":"Go:github.com/argoproj/argo-cd/v2"}}