Skip to content
Log inStart free trial

GHSA-c8xw-vjgf-94hr CVE-2023-40025 GO-2023-2018

Argo CD web terminal session doesn't expire

High Go
Severity
7.1 / 10
High · CVSS 3.1
Exploit chance (EPSS)
0.57%
Chance of exploitation in the next 30 days. Higher than 47.49% of scored vulnerabilities.
Known exploited
No
Not in CISA's catalog
Weakness
CWE-613 Insufficient Session Expiration
Fix
2.6.14
Upgrade github.com/argoproj/argo-cd/v2 to this version or later

Description

Impact

All versions of Argo CD starting from v2.6.0 have a bug where open web terminal sessions do not expire. This bug allows users to send any websocket messages even if the token has already expired. The most straightforward scenario is when a user opens the terminal view and leaves it open for an extended period. This allows the user to view sensitive information even when they should have been logged out already.

Patches

A patch for this vulnerability has been released in the following Argo CD version:

  • v2.6.14
  • v2.7.12
  • v2.8.1

Workarounds

The only way to completely resolve the issue is to upgrade.

Mitigations

Disable web-based terminal or define RBAC rules to it https://argo-cd.readthedocs.io/en/latest/operator-manual/web_based_terminal/

For more information

If you have any questions or comments about this advisory:

Credits

Thank you to bean.zhang (@zhlu32 ) of HIT-IDS ChunkL Team who discovered the issue and reported it confidentially according to our guidelines.

Affected versions

Go

PackageVulnerableFixed in
github.com/argoproj/argo-cd
all versions
 No fix yet
github.com/argoproj/argo-cd/v2
>= 2.6.0, < 2.6.14
2.6.14
github.com/argoproj/argo-cd/v2
>= 2.7.0, < 2.7.12
2.7.12
github.com/argoproj/argo-cd/v2
>= 2.8.0, < 2.8.1
2.8.1
github.com/argoproj/argo-cd/v2
>= 2.0.0-20230718200744-12a5a7a70d6e, < 2.0.0-20230821201509-e047efa8f951
2.0.0-20230821201509-e047efa8f951
github.com/argoproj/argo-cd/v2
>= 2.6.0, < 2.6.14
>= 2.7.0, < 2.7.12
>= 2.8.0, < 2.8.1
2.6.14
2.7.12
2.8.1

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

github.com/argoproj/argo-cd/v2 Go → 2.6.14

go
go get github.com/argoproj/argo-cd/v2@v2.6.14 && go mod tidy

Severity breakdown

CVSS 3.1 7.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Attack vector
Network
Attack complexity
Low
Privileges required
Low
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
Low
Availability
None

Weakness

CWE-613: Insufficient Session Expiration

According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

How to prevent it
  • Implementation: Set sessions/credentials expiration date.

References

Advisories

Packages

Other links

Timeline

  1. Published
  2. Last updated by the source
  3. Latest EPSS score
AdvisorySeverityWhy it's related
GHSA-fmxq-cgp8-87wp
Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks
Critical Also affects github.com/argoproj/argo-cd
GHSA-j6cw-g6p4-7hch
Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL
High Also affects github.com/argoproj/argo-cd
GHSA-h98r-wv3h-fr38
Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation
High Also affects github.com/argoproj/argo-cd
GO-2026-5618
Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations
Medium Also affects github.com/argoproj/argo-cd
GO-2026-5099
ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction
Critical Also affects github.com/argoproj/argo-cd
GHSA-gpx4-37g2-c8pv
Argo CD Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook
High Also affects github.com/argoproj/argo-cd
GHSA-wp4p-9pxh-cgx2
argo-cd vulnerable unauthenticated DoS via malformed Gogs webhook payload
High Also affects github.com/argoproj/argo-cd
GHSA-f9gq-prrc-hrhc
Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload
High Also affects github.com/argoproj/argo-cd
Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor