CVE-2024-41666

Executive Summary

CVE-2024-41666 is a medium-severity vulnerability in Argo CD, a popular GitOps continuous delivery tool for Kubernetes. The flaw resides in the Web-based terminal feature, which allows users to execute commands inside running pods, similar to kubectl exec. Starting from version 2.6.0, if an administrator grants a user the RBAC permission p, role:myrole, exec, create, */*, allow and the user opens a Web terminal session, revoking that specific permission does not terminate the active session. The user can continue to interact with the pod as long as the terminal view remains open. This occurs because the session authorization is checked only at token creation or refresh, not continuously during the session lifecycle.

The vulnerability is distinct from token revocation issues; it specifically concerns the revocation of the RBAC permission itself. While token expiration and user revocation are handled correctly, the permission revocation is not enforced on existing Web terminal sessions. This can lead to unauthorized access to sensitive information within the pod, such as environment variables, configuration files, or application secrets.

No public exploit code or proof-of-concept is available at this time. The EPSS score is 0.0%, indicating a very low probability of exploitation in the wild. However, the vulnerability is considered important due to the potential for information leakage in environments where RBAC permissions are dynamically managed.

Supply Chain & Package Security

Argo CD is distributed as a Go binary and container image. The vulnerability is in the core application logic, not in a third-party package. However, organizations using Argo CD should verify their deployment version and apply the patch immediately. The supply chain risk is low, as the fix is available in official releases.

CVSS Breakdown & Threat Level

• CVSS Score: 4.7 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
• Attack Vector (AV): Network (N) – The vulnerability can be exploited over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – The attacker must have a valid user account with the exec permission.
• User Interaction (UI): Required (R) – The user must have an active Web terminal session.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): Low (L) – Limited information disclosure is possible.
• Integrity (I): Low (L) – Limited ability to modify data.
• Availability (A): Low (L) – Limited impact on availability.

Threat Level: Medium. The vulnerability requires an authenticated user with specific RBAC permissions and an active session. The impact is limited to information leakage and potential low-level integrity/availability issues.

Deep Dive & Mechanics

The Web terminal feature in Argo CD uses WebSockets to provide an interactive shell inside a pod. When a user initiates a terminal session, the server performs an RBAC check to verify that the user has the exec permission for the target resource (e.g., */*). This check is performed at the start of the session and is tied to the user's authentication token.

The vulnerability arises because the session authorization is not re-evaluated when the RBAC permission is revoked. The server maintains a long-lived WebSocket connection, and the authorization decision is cached for the duration of the session. If an administrator revokes the p, role:myrole, exec, create, */*, allow permission, the user's token may still be valid, but the permission check should fail. However, the existing WebSocket connection is not terminated, allowing the user to continue sending commands.

The root cause is a missing permission re-validation hook on the WebSocket connection. The server should listen for RBAC policy changes and terminate active sessions that no longer have the required permissions. Alternatively, the server could perform periodic permission checks during the session.

Key Components:

• Web Terminal Handler: Manages WebSocket connections for terminal sessions.
• RBAC Service: Evaluates user permissions against the current policy.
• Session Manager: Tracks active sessions and their associated permissions.

Attack Scenario:

1. An administrator grants a user the permission p, role:myrole, exec, create, */*, allow.
2. The user opens a Web terminal session to a pod.
3. The administrator revokes the permission (e.g., removes the RBAC policy line).
4. The user's terminal session remains active, allowing continued access to the pod.
5. The user can execute commands, view sensitive data, or potentially modify the pod's state.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// In the WebSocket handler, permission is checked only at connection start.
func handleTerminalSession(w http.ResponseWriter, r *http.Request) {
    user := getUserFromContext(r)
    if !rbacService.CheckPermission(user, "exec", "create", "*/*") {
        http.Error(w, "Forbidden", http.StatusForbidden)
        return
    }
    // Start WebSocket session without further permission checks.
    startWebSocketSession(w, r, user)
}

Patched Code (Conceptual):

// In the WebSocket handler, permission is checked at connection start and periodically.
func handleTerminalSession(w http.ResponseWriter, r *http.Request) {
    user := getUserFromContext(r)
    if !rbacService.CheckPermission(user, "exec", "create", "*/*") {
        http.Error(w, "Forbidden", http.StatusForbidden)
        return
    }
    // Start WebSocket session with a permission re-validation goroutine.
    session := startWebSocketSession(w, r, user)
    go func() {
        ticker := time.NewTicker(30 * time.Second)
        defer ticker.Stop()
        for {
            select {
            case <-ticker.C:
                if !rbacService.CheckPermission(user, "exec", "create", "*/*") {
                    session.Close()
                    return
                }
            case <-session.Done():
                return
            }
        }
    }()
}

The patched code introduces a periodic permission check (every 30 seconds) that terminates the session if the permission is revoked. This ensures that RBAC changes are enforced in near real-time.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to an Argo CD instance (version 2.6.0 to 2.11.6, 2.10.0 to 2.10.15, or 2.9.0 to 2.9.20).
• A valid user account with the exec permission granted via RBAC.
• A running pod in the cluster.

Steps:

1. Obtain Access: Log in to the Argo CD web UI with the user account.
2. Open Terminal: Navigate to an application and click on a pod to open the Web terminal.
3. Maintain Session: Keep the terminal tab open. Do not close or refresh the page.
4. Wait for Revocation: The administrator revokes the exec permission for your user.
5. Execute Commands: Continue to run commands in the terminal. For example:

   cat /etc/kubernetes/admin.conf
   env | grep SECRET
   kubectl get secrets --all-namespaces
   

6. Exfiltrate Data: Copy sensitive output from the terminal.

Note: No public exploit code is available. This is a logical vulnerability that does not require a specific exploit script.

Blue Team

Detection:

• Monitor for long-lived WebSocket connections to Argo CD's terminal endpoint (/api/v1/terminal).
• Alert on terminal sessions that persist beyond the expected session duration or after RBAC changes.
• Use the detection rules provided in the next section.

Prevention:

• Apply the patch immediately (upgrade to 2.11.7, 2.10.16, or 2.9.21).
• Implement network segmentation to limit access to the Argo CD web UI.
• Use short session timeouts and enforce token refresh.
• Monitor RBAC changes and correlate with active terminal sessions.

Hunting:

• Search for terminal sessions that were started before a permission revocation event.
• Look for anomalous commands executed in terminal sessions (e.g., cat /etc/shadow, kubectl get secrets).

Indicators of Compromise (IOCs)

• Network:
  • WebSocket connections to /api/v1/terminal that persist for more than 30 minutes.
  • Multiple terminal sessions from the same user after permission revocation.
• Logs:
  • Argo CD audit logs showing terminal session start events without corresponding end events.
  • RBAC policy change events followed by continued terminal activity from the same user.
• System:
  • Unexpected processes or commands in pod logs that were initiated via the Web terminal.
  • Pods with interactive shells that were not started by legitimate administrators.

Detection Engineering

YARA Rule

rule CVE_2024_41666_ArgoCD_Terminal_Session {
    meta:
        description = "Detects Argo CD Web terminal sessions that may be exploiting CVE-2024-41666"
        author = "Valters IT"
        date = "2024-08-27"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-41666"
        severity = "medium"
    strings:
        $s1 = "/api/v1/terminal" ascii wide nocase
        $s2 = "exec" ascii wide nocase
        $s3 = "create" ascii wide nocase
        $s4 = "WebSocket" ascii wide nocase
    condition:
        all of ($s*) and filesize < 10KB
}

Sigma Rule

title: Argo CD Web Terminal Session After Permission Revocation
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects potential exploitation of CVE-2024-41666 where a user maintains a terminal session after RBAC permission revocation.
author: Valters IT
date: 2024-08-27
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-41666
logsource:
    product: argo-cd
    service: audit
detection:
    selection:
        event_type: "terminal_session_start"
    timeframe: 30m
    condition: selection | count() by user > 1
falsepositives:
    - Legitimate long-running administrative sessions
level: medium
tags:
    - attack.t1553
    - cve.2024.41666

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-41666 Argo CD Web Terminal Session"; flow:to_server,established; content:"/api/v1/terminal"; http_uri; nocase; content:"Upgrade"; http_header; nocase; content:"websocket"; http_header; nocase; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Argo CD: Apply the patch by upgrading to version 2.11.7, 2.10.16, or 2.9.21.

   # For Helm installations
   helm upgrade argo-cd argo/argo-cd --version 5.51.7
   

2. Restrict Terminal Access: If upgrading is not immediately possible, disable the Web terminal feature entirely by setting server.terminal.enabled: false in the Argo CD configuration.
3. Monitor Active Sessions: Use the detection rules above to identify potentially compromised sessions.

Long-Term Mitigations:

• Implement a policy of least privilege for RBAC permissions.
• Use short session timeouts (e.g., 5 minutes) for Web terminal sessions.
• Enable audit logging for all terminal sessions and RBAC changes.
• Regularly review and audit RBAC policies.

Workaround:

• If the Web terminal is required, consider using a reverse proxy that terminates WebSocket connections and re-authenticates users periodically.

Valters IT