Skip to main content
Audit Open Original ↗

Argo

Type

Security review

Client

—

Date

2021-03

Domain

Supply Chain

Effort

4 wks

Section

Cloud-Native Reviews

Trail of Bits's security review of Argo (Mar 2021) identified 35 issues: 3 medium, 16 low, and 16 informational.

Findings · 35

  1. 1 Redis is outdated Informational
  2. 2 Redis does not leverage passphrases Low
  3. 3 Redis does not leverage TLS encryption Low
  4. 4 Lack of container security options Low
  5. 5 Rollouts: Unhandled error when reconciling Istio Virtual Service Low
  6. 6 Unhandled deferred file close operations Low
  7. 7 MinIO container runs as root Low
  8. 8 File extension comparisons are case sensitive Informational
  9. 9 Workflows: HTTP used by default for Web UI Low
  10. 10 Weak TLS version/cipher mode configurations Informational
  11. 11 Workflows: HTTP artifact fetcher will fail on self-signed certificates Informational
  12. 12 Workflows: HTTP artifact fetcher will not use TLS by default Low
  13. 13 Prometheus metrics endpoints do not use TLS Low
  14. 14 Workflows: Git artifact fetcher does not validate revision names Informational
  15. 15 Rollouts: Use of strconv.Atoi when a fixed-width integer is desired Informational
  16. 16 The zJWT auth tokens allow for denial of service in Argo CD Medium
  17. 17 Non-cryptographically secure random function documented as CSPRNG Medium
  18. 18 Symlink in a Git repository allows including files outside of the Git repository path on the Argo CD repo server Low
  19. 19 Providing repository URL in the app creation form clones the repo even if the app is not created Informational
  20. 20 Incorrect logging of command arguments in the RunCommandExt convenience function Informational
  21. 21 An application path may contain path traversal payload that ends up in the application's resulting path Informational
  22. 22 Argo CD CLI suggests that it is possible to create the same application twice Informational
  23. 23 Argo CD file descriptor leak that may lead to exhausting opened file descriptor limit Low
  24. 24 Argo CD contributing guide suggests adding user to the docker group without explaining its security risks Informational
  25. 25 Argo CD command line does not warn about too broad permissions of Argo token file Low
  26. 26 Argo CD website lacks Content Security Policy and uses the X-XSS-Protection header with mode: 1 Low
  27. 27 Argo Events authentication token generated using weak PRNG Low
  28. 28 Argo Events NATS streaming service does not use TLS by default Low
  29. 29 Argo CD may return an incorrect error message for a missing claim in the numField function Informational
  30. 30 Argo CD: the getToken function parses multiple tokens instead of using the first valid one Informational
  31. 31 The WaitPID function is vulnerable to a PID-reuse attack Informational
  32. 32 Argo CD Web UI does not support changing local admin password Informational
  33. 33 Argo CD does not invalidate token for local admin on logout Low
  34. 34 Argo projects do not provide documentation for release cycle Informational
  35. 35 Packages with security vulnerabilities in Argo-CD and Argo Workflows UI Medium

Findings extracted from the published report PDF. See the full report below for details and remediation.

Related