Cross-Site Scripting (XSS) in github.com/argoproj/argo-cd (CVE-2024-28175)

Summary

Cross-site scripting in github.com/argoproj/argo-cd (CVE-2024-28175). Successful exploitation can lead to full system takeover. Exploitable via link.argocd.argoproj.io. Mitigation: upgrade to 2.8.12 or later.

Original description

The description as published by the source.

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Due to the improper URL protocols filtering of links specified in the link.argocd.argoproj.io annotations in the application summary component, an attacker can achieve cross-site scripting with elevated permissions. All unpatched versions of Argo CD starting with v1.0.0 are vulnerable to a cross-site scripting (XSS) bug allowing a malicious user to inject a javascript: link in the UI. When clicked by a victim user, the script will execute with the victim's permissions (up to and including admin). This vulnerability allows an attacker to perform arbitrary actions on behalf of the victim via the API, such as creating, modifying, and deleting Kubernetes resources. A patch for this vulnerability has been released in Argo CD versions v2.10.3 v2.9.8, and v2.8.12. There are no completely-safe workarounds besides upgrading. The safest alternative, if upgrading is not possible, would be to create a Kubernetes admission controller to reject any resources with an annotation starting with link.argocd.argoproj.io or reject the resource if the value use an improper URL protocol. This validation will need to be applied in all clusters managed by ArgoCD.

Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV

Auto-generated summary

Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.

A vulnerability tracked as CVE-2024-28175 has been found in github.com/argoproj/argo-cd.
Attackers can target a specific entry point like link.argocd.argoproj.io over the network to misuse the product.
Successful exploitation can lead to full system takeover.
What to do: upgrade github.com/argoproj/argo-cd to 2.8.12 or later.
If unsure, ask your IT team or search "github.com/argoproj/argo-cd CVE-2024-28175" on the vendor's site.

CVE-2024-28175 (github.com/argoproj/argo-cd) — CWE-79
Attack vector: remote (network-reachable)
Attack surface: link.argocd.argoproj.io
Patched: 2.8.12 — apply immediately
Workaround: There are no completely-safe workarounds besides upgrading.
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.

❓ What is the problem

Cross-site scripting (XSS) (CWE-79) exists in github.com/argoproj/argo-cd. Attackers reach the vulnerable code path via link.argocd.argoproj.io.

📍 Affected scope

Check the vendor advisory for the affected versions of github.com/argoproj/argo-cd. Attack surface: link.argocd.argoproj.io.

🔥 Severity

Severity: ?. Successful exploitation can lead to full system takeover.

🔧 How to fix

Update to 2.8.12.

🛡️ Workaround

Workaround: There are no completely-safe workarounds besides upgrading.

🔍 Detection

Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Run grep -r 'github.com/argoproj/argo-cd' . against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.

Response actions

Concrete steps and command examples for SOC/SRE teams to execute in order

1
Identify exposure identify
```
grep -r 'github.com/argoproj/argo-cd' . | grep -v node_modules
```
リポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で github.com/argoproj/argo-cd を grep し、稼働しているサービス・バージョンを把握する。
2
Apply temporary workaround mitigate
```
There are no completely-safe workarounds besides **upgrading**.
```
パッチが適用されるまでの応急処置として、There are no completely-safe workarounds besides upgrading. を実施。回避策の副作用 (機能低下) を確認した上で。
3
Apply patch patch
```
Upgrade github.com/argoproj/argo-cd to 2.8.12
```
ステージング環境で 2.8.12 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスを含めること。
4
Post-deployment verification verify
```
Confirm patched version is live in production
```
パッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。

Affected packages

Go github.com/argoproj/argo-cd

[{"type":"SEMVER","events":[{"introduced":"1.0.0"},{"last_affected":"1.8.7"}]}]

Go github.com/argoproj/argo-cd/v2

[{"type":"SEMVER","events":[{"introduced":"2.0.0"},{"fixed":"2.8.12"}]}]

Bitnami argo-cd

[{"type":"SEMVER","events":[{"introduced":"1.0.0"},{"fixed":"2.10.3"}]}]

References

advisory github.com
package github.com
patch github.com
web nvd.nist.gov