Detections
Analytics
SCA: security update for github.com/argoproj/argo-cd/v2 (GHSA-92mw-q256-5vwg)
high Tenable Self-Hosted Container Security Plugin ID 412963
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The Argo CD API prior to
versions 2.10-rc2, 2.9.4, 2.8.8, and 2.7.15 are vulnerable to a cross-server request forgery (CSRF) attack
when the attacker has the ability to write HTML to a page on the same parent domain as Argo CD. A CSRF
attack works by tricking an authenticated Argo CD user into loading a web page which contains code to call
Argo CD API endpoints on the victim’s behalf. For example, an attacker could send an Argo CD user a link
to a page which looks harmless but in the background calls an Argo CD API endpoint to create an
application running malicious code. Argo CD uses the “Lax” SameSite cookie policy to prevent CSRF attacks
where the attacker controls an external domain. The malicious external website can attempt to call the
Argo CD API, but the web browser will refuse to send the Argo CD auth token with the request. Many
companies host Argo CD on an internal subdomain. If an attacker can place malicious code on, for example,
https://test.internal.example.com/, they can still perform a CSRF attack. In this case, the “Lax” SameSite
cookie does not prevent the browser from sending the auth cookie, because the destination is a parent
domain of the Argo CD API. Browsers generally block such attacks by applying CORS policies to sensitive
requests with sensitive content types. Specifically, browsers will send a “preflight request” for POSTs
with content type “application/json” asking the destination API “are you allowed to accept requests from
my domain?” If the destination API does not answer “yes,” the browser will block the request. Before the
patched versions, Argo CD did not validate that requests contained the correct content type header. So an
attacker could bypass the browser’s CORS check by setting the content type to something which is
considered “not sensitive” such as “text/plain.” The browser wouldn’t send the preflight request, and Argo
CD would happily accept the contents (which are actually still JSON) and perform the requested action
(such as running malicious code). A patch for this vulnerability has been released in the following Argo
CD versions: 2.10-rc2, 2.9.4, 2.8.8, and 2.7.15. The patch contains a breaking API change. The Argo CD API
will no longer accept non-GET requests which do not specify application/json as their Content-Type. The
accepted content types list is configurable, and it is possible (but discouraged) to disable the content
type check completely. Users are advised to upgrade. There are no known workarounds for this
vulnerability. (CVE-2024-22424)
See Also
Plugin Details
Severity: High
ID: 412963
Version: Revision 1.5
Type: Local
Family: SCA Checks
Published: 1/23/2025
Updated: 6/1/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Medium
Score: 5
Percentile: 94.66
Vendor
Vendor Severity: High
CVSS v2
Risk Factor: High
Base Score: 7.6
Temporal Score: 6
Vector: CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C
CVSS Score Source: CVE-2024-22424
CVSS v3
Risk Factor: High
Base Score: 8.3
Temporal Score: 7.5
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
Vulnerability Information
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 1/19/2024
Vulnerability Publication Date: 1/19/2024
Reference Information
CVE: CVE-2024-22424
cwe: CWE-352