CVE-2022-31035 External URLs for Deployments can include javascript in argo-cd
Attackers can inject JavaScript into Argo CD deployment URLs, allowing execution with victim permissions to modify Kubernetes resources.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2022-31035?
CVE-2022-31035 is a critical cross-site scripting vulnerability in Argoproj Argo Cd, published on 27 Jun 2022. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of Argo CD starting with v1.0.0 are vulnerable to a cross-site scripting (XSS) bug allowing a malicious user to inject a `javascript:` link in the UI. When clicked by a victim user, the script will execute with the victim's permissions (up to and including admin). The script would be capable of doing anything which is possible in the UI or via the API, such as creating, modifying, and deleting Kubernetes resources. A patch for this vulnerability has been released in the following Argo CD versions: v2.4.1, v2.3.5, v2.2.10 and v2.1.16. There are no completely-safe workarounds besides upgrading.
Weakness: CWE-79
Which versions are affected by CVE-2022-31035?
12 open source packages ship an affected version, including github.com/argoproj/argo-cd/v2 and github.com/argoproj/argo-cd. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/argoproj/argo-cd/v2 Go | All versions | 2.1.16, 2.2.10, 2.3.5, 2.4.1 |
github.com/argoproj/argo-cd/v2 Go | All versions | 2.1.16 |
github.com/argoproj/argo-cd/v2 Go | All versions | 2.1.16 |
github.com/argoproj/argo-cd/v2 Go | From 2.2.0 | 2.2.10 |
github.com/argoproj/argo-cd/v2 Go | From 2.2.0 | 2.2.10 |
github.com/argoproj/argo-cd/v2 Go | From 2.3.0 | 2.3.5 |
6 more packages
github.com/argoproj/argo-cd/v2 Go | From 2.3.0 | 2.3.5 |
github.com/argoproj/argo-cd/v2 Go | From 2.4.0 | 2.4.1 |
github.com/argoproj/argo-cd/v2 Go | From 2.4.0 | 2.4.1 |
github.com/argoproj/argo-cd Go | From 1.0.0 | None |
github.com/argoproj/argo-cd Go | From 1.0.0 | 2.1.16 |
github.com/argoproj/argo-cd Go | From 1.0.0 | 2.1.16 |
Products include Argoproj Argo Cd.
How do I fix CVE-2022-31035?
Upgrade github.com/argoproj/argo-cd/v2 to a fixed version for your release line: 2.1.16, 2.2.10, 2.3.5 or 2.4.1.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2022-31035 being exploited?
There is no known exploitation of CVE-2022-31035 in the wild and no public exploit code.
Other vulnerabilities in Argoproj Argo Cd
- CVE-2025-55190 Argo CD: Project API Token Exposes Repository Credentials
- CVE-2022-29165 Argo CD will blindly trust JWT claims if anonymous access is enabled
- CVE-2023-40029 Cluster secret might leak in cluster details page in Argo CD
- CVE-2022-24768 Improper access control allows admin privilege escalation in Argo CD
- CVE-2024-21652 Argo CD vulnerable to Bypassing of Brute Force Protection via Application Crash and In-Memory Data Loss
Sources
Also known as GHSA-h4w9-6x78-8vrj, GO-2022-0498.