GHSA-rc7p-gmvh-xfx2 Attack on Kubernetes via Misconfigured Argo Workflows
Remote attackers can execute arbitrary code on Kubernetes clusters if Argo Server UI is exposed with default server auth mode.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is GHSA-rc7p-gmvh-xfx2?
GHSA-rc7p-gmvh-xfx2 is a vulnerability in github.com/argoproj/argo-workflows, published on 2 Aug 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Impact
Users running using the Argo Server with --auth-mode=server (which is the default < v3.0.0) AND have exposed their UI to the Internet may allow remote users to execute arbitrary code on their cluster, e.g. crypto-mining.
Resolution
- Do not expose your user interface to the Internet.
- Change configuration.
--auth-mode=client.
For users using an older 2.x version of Argo Server, consider upgrading to Argo Server version 3.x or later.
Which versions are affected by GHSA-rc7p-gmvh-xfx2?
2 open source packages ship an affected version, including github.com/argoproj/argo-workflows.
| Package | Affected | Fixed in |
|---|---|---|
github.com/argoproj/argo-workflows Go | All versions | None |
github.com/argoproj/argo-workflows Go | All versions | None |
How do I fix GHSA-rc7p-gmvh-xfx2?
No fix has been published for GHSA-rc7p-gmvh-xfx2 yet. Limit exposure of the affected software until one is available.
Is GHSA-rc7p-gmvh-xfx2 being exploited?
There is no known exploitation of GHSA-rc7p-gmvh-xfx2 in the wild and no public exploit code.