CVE-2024-31989: ArgoCD Vulnerable to Use of Risky or Missing Cryptographic Algorithms in Redis Cache

Should you act?

Critical, preconditions apply

Severe if exploited, but exploitation needs conditions that may not apply to you. This signal is computed from CISA KEV, EPSS and CVSS data; it is not an editorial verdict.

• Not in CISA KEV, but CISA’s SSVC assessment records a public proof-of-concept, so attack code exists.
• EPSS 1.5%, percentile 74: FIRST’s model estimates a 1.5% chance of exploitation activity in the next 30 days, higher than 74% of all scored CVEs (moderate). EPSS is a probability, not a verdict.
• Needs an account (low (any account)). Exposure depends on who can log in.
• Only applies if your dependency tree includes github.com/argoproj/argo-cd/v2 (Go) < 2.8.19, fixed in 2.8.19; github.com/argoproj/argo-cd/v2 (Go) >= 2.9.0-rc1, < 2.9.15, fixed in 2.9.15; github.com/argoproj/argo-cd/v2 (Go) >= 2.10.0-rc1, < 2.10.10, fixed in 2.10.10; github.com/argoproj/argo-cd/v2 (Go) >= 2.11.0-rc1, < 2.11.1, fixed in 2.11.1. Check your lockfile, including transitive dependencies.

What it is

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. It has been discovered that an unprivileged pod in a different namespace on the same cluster could connect to the Redis server on port 6379. Despite having installed the latest version of the VPC CNI plugin on the EKS cluster, it requires manual enablement through configuration to enforce network policies. This raises concerns that many clients might unknowingly have open access to their Redis servers. This vulnerability could lead to Privilege Escalation to the level of cluster controller, or to information leakage, affecting anyone who does not have strict access controls on their Redis instance. This issue has been patched in version(s) 2.8.19, 2.9.15 and 2.10.10.

From the GitHub advisory

Summary By default, the Redis database server is not password-protected. Consequently, an attacker with access to the Redis server can gain read/write access to the data in Redis. The attacker can also modify the "mfst" (manifest) key to cause ArgoCD to execute any deployment, potentially leveraging ArgoCD's high privileges to take over the cluster. Updating the "cacheEntryHash" in the manifest JSON is necessary, but since it doesn't use a private key for signing its integrity, a simple script can generate a new FNV64a hash matching the new manifest values. The repo-server, unable to verify if its cache is compromised, will read the altered "mfst" key and initiate an update process for the injected deployment.

It's also possible to edit the "app|resources-tree" key, causing the ArgoCD server to load any Kubernetes resource into the live manifest section of the app preview. This could lead to an information leak.

The fact that the cache in Redis is neither signed nor validated, combined with Redis's default lack of password protection, presents a significant security concern given ArgoCD's high-level permissions within the cluster. A security update should ensure all Redis database values are signed or encrypted.

Details We began by deploying ArgoCD on an EKS cluster. Surprisingly, we discovered that an unprivileged pod in a different namespace on the same cluster could connect to the Redis server on port 6379. This was unexpected, as we had observed network policy rules restricting access to the Redis server to only the pods application-controller, repo-server, and argocd-server. We later realized that, despite having installed the latest version of the VPC CNI plugin on the EKS cluster, it requires manual enablement through configuration to enforce network policies. This raises concerns that many clients might unknowingly have open access to their Redis servers. We also know your recommendation on this page Argo CD - Secret Management, to enable the network policy plugin. Further investigation revealed that any pod within my cluster could connect to the Redis server by resolving its address using the Kubernetes DNS server. Exploring the contents of the Redis server, we found that we could edit the 'mfst' value of the…

Weakness type: CWE-327.

Product: github.com/argoproj/argo-cd/v2 (Go) · Assigned by: GitHub_M · Published: 2024-05-21

Affected and fixed versions

Severity scores

• Attack vector: adjacent network only
• Attack complexity: low
• Privileges required: low (any account)
• User interaction: none
• Scope: changed (can affect other components)

CVSS measures how bad a flaw is if exploited, not how likely exploitation is. Read it next to the exploitation data below.

Exploitation and urgency

• CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
• CISA SSVC assessment: exploitation poc, automatable no, technical impact total.
• FIRST EPSS (model of 2026-10-21): 1.48% probability of exploitation activity in the next 30 days; percentile 74.

Timeline

• 2024-05-21 — CVE record published by GitHub_M
• 2024-05-21 — GitHub-reviewed advisory GHSA-9766-5277-j5hr published (critical)
• 2024-08-02 — CVE record last updated

Sources and references

Original sources first. Version and fix details should always be confirmed against the vendor or project advisory.

Vulnerability records

1. GitHub Advisory GHSA-9766-5277-j5hr github.com
2. CVE.org record CVE-2024-31989 cve.org
3. NVD entry CVE-2024-31989 nvd.nist.gov

Other references from the CVE record and advisory

1. github.com github.com
2. github.com github.com
3. github.com github.com
4. github.com github.com
5. github.com github.com
6. github.com github.com
7. github.com github.com
8. github.com github.com
9. github.com github.com

Critical Go advisories · Today’s Security Digest