CVE-2024-28175

Summary

CVE-2024-28175 is a cross-site scripting (XSS) vulnerability in Argo CD, a GitOps continuous delivery tool for Kubernetes. Due to insufficient filtering of URLs in the `link.argocd.argoproj.io` annotations, an attacker can inject a malicious javascript link into the Argo CD user interface. If clicked by a victim, the script executes with the victim's permissions, potentially allowing the attacker to perform arbitrary actions on behalf of the victim via the Argo CD API. This includes creating, modifying, and deleting Kubernetes resources. Unpatched Argo CD versions starting with v1.0.0 are affected. The vulnerability has been addressed in versions v2.10.3, v2.9.8, and v2.8.12. Despite some workarounds, the safest solution is to upgrade or apply custom admission controller rules to reject or validate `link.argocd.argoproj.io` annotations or URLs in all managed clusters.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.