ArgoCD vulnerability exploitation skills
- Product: Argo CD (Kubernetes declarative GitOps continuous delivery tool)
- Default ports: 80/443 (Web UI), 8080 (Server), 6379 (Redis)
- Identification characteristics: Page title "Argo CD",
/api/v1/version returns version information
- Default credentials: admin / auto-generated initial password
- FOFA:
app="Argo-CD" | Shodan: http.title:"Argo CD"
Vulnerability overview
| CVE |
Affected versions |
Type |
Conditions |
Impact |
| CVE-2024-31989 |
<2.11.5 |
Redis cache poisoning → K8s takeover |
Redis unauthenticated |
Critical (9.1) |
| CVE-2022-29165 |
<2.3.1 |
SSO authentication bypass |
OIDC SSO configured |
High (8.8) |
| CVE-2023-22482 |
Multiple versions |
Redis information disclosure |
Redis unauthenticated |
High (7.5) |
| CVE-2024-40638 |
Multiple versions |
Webhook SSRF |
Authenticated user |
High (7.2) |
| Default credentials |
All versions |
Initial admin password |
Obtain initial password |
Critical |
Exploitation decision tree
1. 识别ArgoCD → /api/v1/version
2. 未授权API → /api/v1/applications, /api/v1/clusters
3. CVE-2024-31989 (优先) → Redis缓存投毒 → 集群接管
4. 默认凭据 → admin + 初始密码 → 完全控制
5. CVE-2022-29165 (SSO环境) → redirect_uri绕过
6. CVE-2024-40638 → Webhook SSRF
7. 已认证后利用 → 恶意Application / 注入Manifest / 越权
Exploitation chain priority
1. Redis未授权 → CVE-2024-31989缓存投毒 → K8s集群接管
2. 默认凭据/弱口令 → ArgoCD完全控制
3. 未授权API → 应用/集群/仓库信息泄露
4. CVE-2022-29165 → SSO认证绕过
5. CVE-2024-40638 → Webhook SSRF → 内部服务探测
6. 已认证 → 创建恶意Application → 特权Pod部署
Common endpoints quick reference
| Endpoint |
Method |
Purpose |
Authentication |
/api/v1/version |
GET |
Version information |
Not required |
/api/v1/applications |
GET |
Application list |
Optional |
/api/v1/clusters |
GET |
Cluster list |
Optional |
/api/v1/repositories |
GET |
Repository list |
Optional |
/api/v1/account |
GET |
Account information |
Optional |
/auth/login |
GET |
Login page |
Not required |
Redis 6379 |
- |
Cache service |
No password by default |
Detailed reference
