{"id":"CVE-2022-24904","published":"2022-05-20T13:55:11Z","modified":"2025-04-23T18:25:13Z","title":"Symlink following allows leaking out-of-bound manifests and JSON files from Argo CD repo-server","vendor":"argoproj","product":"argo-cd","tier":"tail","description":{"text":"Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with version 0.7.0 and prior to versions 2.1.15m 2.2.9, and 2.3.4 is vulnerable to a symlink following bug allowing a malicious user with repository write access to leak sensitive files from Argo CD's repo-server. A malicious Argo CD user with write access for a repository which is (or may be) used in a directory-type Application may commit a symlink which points to an out-of-bounds file. Sensitive files which could be leaked include manifest files from other Applications' source repositories (potentially decrypted files, if you are using a decryption plugin) or any JSON-formatted secrets which have been mounted as files on the repo-server. A patch for this vulnerability has been released in Argo CD versions 2.3.4, 2.2.9, and 2.1.15. Users of versions 2.3.0 or above who do not have any Jsonnet/directory-type Applications may disable the Jsonnet/directory config management tool as a workaround.","provenance":"source","from":"CVE.org"},"cvss":{"score":4.3,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.01151,"percentile":0.66831,"provenance":"source"},"cwes":[{"id":"CWE-61","name":"UNIX Symbolic Link (Symlink) Following"},{"id":"CWE-59","name":"Improper Link Resolution Before File Access"}],"references":[{"url":"https://github.com/argoproj/argo-cd/security/advisories/GHSA-6gcg-hp2x-q54h","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/argoproj/argo-cd/releases/tag/v2.1.15","tags":["x_refsource_MISC"]},{"url":"https://github.com/argoproj/argo-cd/releases/tag/v2.2.9","tags":["x_refsource_MISC"]},{"url":"https://github.com/argoproj/argo-cd/releases/tag/v2.3.4","tags":["x_refsource_MISC"]}],"priority":{"score":16.4,"factors":[{"name":"EPSS percentile","points":13.37},{"name":"CVSS severity","points":3.01}]},"vendorSlug":"argoproj","affectedVersions":[{"vendor":"argoproj","product":"argo-cd","versions":[">= 0.7.0, < 2.1.15",">= 2.2.0, < 2.2.9",">= 2.3.0, < 2.3.4"]}],"affected":[{"ecosystem":"Go","package":"github.com/argoproj/argo-cd/v2","vulnerableRanges":["<2.1.15",">=2.2.0, <2.2.9",">=2.3.0, <2.3.4"],"patched":["2.1.15","2.2.9","2.3.4"],"from":["GHSA-6gcg-hp2x-q54h","GO-2022-0453"],"provenance":"source"},{"ecosystem":"Go","package":"github.com/argoproj/argo-cd","vulnerableRanges":["all versions"],"patched":[],"from":["GO-2022-0453"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-2791","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-argoproj-argo-cd-cve-2022-24904","children":[{"from":"CVE-2022-24904","to":"CVE-2026-113672","relation":"related","confidence":"high","kind":"lineage","evidence":[{"kind":"osv-related","provenance":"source","id":"GHSA-6gcg-hp2x-q54h","via":"related"},{"kind":"same-code","provenance":"machine","files":["reposerver/repository/repository.go"],"commits":["https://github.com/argoproj/argo-cd/commit/5e767a4b9e30983330c0fdec322192281a90eb84","https://github.com/argoproj/argo-cd/commit/7357cfdb58a560de70a0538c6e3bef6fe39505ea","https://github.com/argoproj/argo-cd/commit/27471d524958878e7acc5131fb466b292079cd05"],"basis":"shared function","functions":["findManifests","ksShow"]}]}],"packageHistory":[{"cve":"CVE-2023-40026","published":"2023-09-27","fixed":"2.3.0","kev":false},{"cve":"CVE-2022-1025","published":"2022-07-12","fixed":"2.3.2","kev":false},{"cve":"CVE-2022-24768","published":"2022-03-23","fixed":"2.3.2","kev":false,"link":{"from":"CVE-2022-24768","to":"CVE-2022-24904","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/argoproj/argo-cd/v2","fromFixed":"2.1.14","toFixed":"2.1.15","daysApart":58}]}},{"cve":"CVE-2022-24904","published":"2022-05-20","fixed":"2.3.4","kev":false},{"cve":"CVE-2022-24905","published":"2022-05-20","fixed":"2.3.4","kev":false},{"cve":"CVE-2022-29165","published":"2022-05-20","fixed":"2.3.4","kev":false},{"cve":"CVE-2022-31016","published":"2022-06-25","fixed":"2.4.1","kev":false}],"package":"Go:github.com/argoproj/argo-cd/v2"}}