# Usalama wa Argo CD

{{#include ../banners/hacktricks-training.md}}

## Taarifa za Msingi

[Argo CD](https://argo-cd.readthedocs.io/) ni jukwaa la GitOps continuous delivery kwa Kubernetes. Hufuatilia Git repositories, hutengeneza Kubernetes manifests kwa kutumia tools kama vile Helm, Kustomize, Jsonnet au config management plugins, na husawazisha hali halisi ya cluster na hali inayotakiwa iliyohifadhiwa kwenye Git.

Kwa mtazamo wa attacker, ichukulie Argo CD kama **deployment engine yenye Kubernetes credentials**. Argo CD ikicompromise inaweza kusababisha:

- Access kwa private Git repositories na repository credentials.
- Access kwa Kubernetes cluster secrets zinazotumiwa na Argo CD.
- Code execution ya manifest generation ndani ya `argocd-repo-server`.
- Deployment isiyoidhinishwa ya Kubernetes objects kupitia trusted Git repositories, Argo CD applications au cache manipulation.

## Architecture na Components Muhimu

Kubernetes objects na services za kawaida:
```bash
kubectl get pods,svc,endpoints,ingress -A | grep -iE 'argocd|argo-cd'
kubectl get applications,appprojects,applicationsets -A 2>/dev/null
kubectl get secrets,configmaps -n argocd 2>/dev/null
kubectl get networkpolicy -n argocd 2>/dev/null
```
Huduma muhimu:

- **`argocd-server`**: API ya umma, web UI, CLI API, authentication na authorization.
- **`argocd-application-controller`**: hulinganisha hali inayotarajiwa na hali halisi, kisha hutumia resources kwenye Kubernetes.
- **`argocd-repo-server`**: hu-clone repositories, huhifadhi Git data kwenye cache, na huendesha Helm/Kustomize/Jsonnet/plugins ili kutengeneza manifests. Port ya default ya gRPC ni **8081**.
- **`argocd-redis`**: cache ya application, manifest na Git reference data. Port ya default ya Redis ni **6379**.
- **`argocd-applicationset-controller`**: hutengeneza Argo CD `Application` objects kutoka kwa generators kama Git, SCM, clusters na pull requests.

Kutoka kwenye pod iliyo-compromise au internal network segment, kagua internal reachability:
```bash
nc -vz <argocd-server> 443
nc -vz <argocd-repo-server> 8081
nc -vz <argocd-redis> 6379
```
## Mashambulizi ya Public API / UI

Ikiwa una credentials za Argo CD au instance iliyo wazi, anza na API surface ya kawaida:
```bash
argocd login <argocd-server>
argocd account get-user-info
argocd account list
argocd proj list
argocd app list
argocd repo list
argocd cluster list
argocd admin settings rbac can <subject> <action> <resource> <object>
```
Njia muhimu za attack:

- **Application write access**: badilisha `source.repoURL`, `source.path`, thamani za Helm, chaguo za Kustomize, mipangilio ya plugin au chaguo za sync ili Argo CD ideploy manifests zinazodhibitiwa na mshambuliaji.
- **Project misconfiguration**: objects za `AppProject` zinaweza kuruhusu `sourceRepos` pana, `destinations` pana, `clusterResourceWhitelist` isiyo salama au vizuizi dhaifu vya namespace.
- **Repository credential abuse**: secrets za repository, credentials za GitHub App, SSH keys na tokens zinaweza kuruhusu kusukuma mabadiliko kwenye repos zinazoaminika au kuongeza dependencies hasidi.
- **Cluster credential abuse**: secrets za cluster zinaweza kuwa na bearer tokens au usanidi wa exec-provider unaotumiwa na Argo CD kufanya deploy kwenye target clusters.
- **Local admin / project tokens**: Argo CD tokens za muda mrefu zinaweza kutumiwa tena kupitia API isipokuwa zifutwe au zi-expire.

Enumerate usanidi kutoka Kubernetes unapokuwa na cluster read access:
```bash
kubectl get applications.argoproj.io -A -o yaml
kubectl get appprojects.argoproj.io -A -o yaml
kubectl get applicationsets.argoproj.io -A -o yaml
kubectl get secrets -n argocd -o yaml | grep -nE 'repoURL|sshPrivateKey|password|bearerToken|githubApp|tlsClientCertData|tlsClientCertKey'
kubectl get cm -n argocd argocd-cm argocd-rbac-cm argocd-cmd-params-cm -o yaml
```
## Matumizi Mabaya ya Git Repository Inayoaminika

Ikiwa unaweza kufanya push kwenye repository inayoaminika na Argo CD, kwa kawaida unaweza kuathiri kitakachodeployiwa. Athari hutegemea mipaka ya `AppProject` na permissions za service account zinazotumiwa na application controller.

Maeneo ya kawaida ya payload:

- Raw Kubernetes YAML chini ya application path.
- Helm chart templates na `values.yaml`.
- Kustomize overlays, remote bases na generators.
- Jsonnet au input ya config management plugin.
- ApplicationSet generator files zinazounda au kusasisha objects za `Application`.

Kagua ikiwa app inatumia automated sync, pruning, self-heal, sync windows au manual approvals:
```bash
kubectl get applications.argoproj.io -A \
-o custom-columns='NS:.metadata.namespace,APP:.metadata.name,PROJECT:.spec.project,AUTOSYNC:.spec.syncPolicy.automated,REPO:.spec.source.repoURL,PATH:.spec.source.path,DEST:.spec.destination.server'
```
## Abuse ya moja kwa moja ya `argocd-repo-server`

Usidhani kuwa Argo CD API ya umma ndiyo attack surface pekee. Vipengele vya ndani vya Argo CD huwasiliana na `argocd-repo-server` kupitia gRPC. Ikiwa pods holela zinaweza kufikia repo-server, requests za ndani zinazodhibitiwa na attacker zinaweza kukwepa ukaguzi unaotekelezwa kwa kawaida na `argocd-server`.

Ukaguzi wa vitendo:
```bash
kubectl get svc -n argocd argocd-repo-server -o yaml
kubectl get endpoints -n argocd argocd-repo-server -o wide
nc -vz <argocd-repo-server> 8081
```
Dalili muhimu:

- Endpoint ya gRPC ya repo-server inafikika kutoka kwa pods zisizo za Argo CD.
- NetworkPolicies hazipo, au zinaruhusu tu egress bila kuzuia ingress.
- Repo-server ina ufikiaji wa custom config management plugins, zana za decryption, au maudhui ya repository kutoka kwa tenants wengi.
- Redis inafikika kutoka kwa pods zisizo za Argo CD, hivyo kuruhusu ukaguzi au tampering ya cache ikiwa credentials zinapatikana au hazihitajiki.

## Unauthenticated Repo-Server RCE via Kustomize Options

Mnamo Julai 2026, Synacktiv ilifichua code execution chain isiyohitaji authentication katika `repo-server` ya Argo CD, wakati mshambuliaji anaweza kufikia internal gRPC service. Shambulio hili hutumia vibaya ufikiaji wa moja kwa moja wa `/repository.RepoServerService/GenerateManifest` pamoja na `KustomizeOptions` zinazodhibitiwa na mshambuliaji.

Primitive hatari ni kulazimisha repo-server ku-clone maudhui ya repository yanayodhibitiwa na mshambuliaji na kuendesha Kustomize ikiwa na support ya Helm:
```bash
kustomize build <attacker_repo_path> --enable-helm --helm-command ./payload.sh
```
Input ndogo hasidi ya Kustomize inahitaji kuchochea uchakataji wa Helm:
```yaml
helmCharts:
- name: pwn
version: 0.0.1
```
Kwa nini hii inafanya kazi:

- `argocd-repo-server` hu-clone repository kabla ya ku-render.
- `--helm-command ./payload.sh` hutatuliwa ikiwa relative kwa repository iliy-clone.
- Code execution haihitaji shell metacharacter injection ikiwa attacker anaweza kudhibiti repository iliy-render na chaguo za Kustomize build.

Wakati wa disclosure ya Synacktiv ya Julai 1, 2026, waliripoti kwamba issue hiyo haikuwa na official fix wala CVE. Ichukulie kwanza kama issue ya network exposure: exploitation inahitaji kufikika kwa internal repo-server gRPC port.

## Redis Cache Poisoning ya Ku-deploy Manifests

Baada ya code execution katika `argocd-repo-server`, au baada ya kupata direct access kwa Redis kwa valid credentials, kagua cache entries zinazotumia Redis. Argo CD kwa kawaida huhifadhi values za JSON zilizobanwa kwa gzip.

Key prefixes zinazovutia:
```text
mfst|...       # cached rendered manifests
git-refs|...   # Git branch/ref to commit mappings
app|...        # application resource/cache data
cluster|...    # cluster cache information
```
The cache poisoning attack iliyoelezwa na Synacktiv hutumia sehemu mbili za state:

1. Rekebisha cache entry husika ya `mfst|...` ili ijumuishwe Kubernetes manifest inayodhibitiwa na attacker.
2. Rekebisha mapping inayohusiana ya `git-refs|...` ili Argo CD iamini kuwa branch imehamishwa, kisha ifanye reconcile kurudi kwenye revision iliyo kwenye cache.

Impact:

- Auto Sync ikiwa imewashwa, Argo CD inaweza kutumia poisoned cached manifest automatically.
- Bila Auto Sync, payload bado inaweza kutumika wakati user anafanya sync ya application manually.
- Impact ya mwisho inawekewa kikomo na destination ya target application pamoja na Kubernetes permissions zinazopatikana kwa Argo CD.

## ApplicationSet Attacks

ApplicationSet ni nyeti hasa kwa sababu huunda au kusasisha `Application` objects kutokana na generator output.

Review:
```bash
kubectl get applicationsets.argoproj.io -A -o yaml
kubectl get appprojects.argoproj.io -A -o yaml
```
Mifumo ya kuvutia:

- Git generators zinazosoma files zinazoweza kuandikwa na attacker, zinazodhibiti majina ya apps, paths, projects au destinations.
- Pull request generators za public repositories ambapo contributors wasioaminika wanaweza kushawishi applications zinazozalishwa.
- Template fields zinazoruhusu destination clusters/namespaces pana.
- AppProjects zinazoruhusu `sourceRepos: ["*"]` au `destinations` pana.
- Applications zinazozalishwa ambazo hurithi automated sync na pruning.

## Post-Exploitation

Kutoka kwenye pod shell ya Argo CD, prioritise:
```bash
env
cat /proc/1/environ 2>/dev/null | tr '\0' '\n'
find /var/run/secrets /app/config -type f -maxdepth 4 2>/dev/null
mount | grep -E 'secret|token|config'
```
Malengo muhimu:

- Kuiba `REDIS_PASSWORD` au TLS/client material ya Redis.
- Kutoa repository credentials kutoka kwenye secrets zilizomountiwa au Argo CD Kubernetes secrets.
- Kutambua cluster credentials zinazotumiwa na Argo CD.
- Kusoma generated manifests na plugin output ambazo zinaweza kujumuisha injected secrets.
- Kuangalia kama custom plugins, SOPS, Helm secrets, Vault plugins au cloud CLIs zinafichua decryption keys na cloud credentials.

## Detection & Hardening

Ukaguzi muhimu:

- Zuia `argocd-repo-server` port **8081** na Redis port **6379** kwa kutumia NetworkPolicies, ili vipengele vya Argo CD vinavyotarajiwa pekee viweze kuzifikia.
- Katika Helm deployments, thibitisha kuwa network policies zinaundwa kweli. Argo CD Helm chart values kihistoria zimeweka component network policy creation kuwa disabled kwa default.
- Weka `argocd-server` kama authenticated entry point. Internal services hazipaswi kufikiwa kutoka kwa arbitrary workloads.
- Zima config management tools na plugins zisizotumika.
- Zuia `AppProject` `sourceRepos`, `destinations`, namespace permissions na cluster-scoped resources.
- Epuka kuhifadhi broad repository credentials mahali ambapo Argo CD user mwenye low privilege anaweza kusababisha zitumike tena.
- Fuatilia repo-server requests, Kustomize build options, plugin executions, Redis writes na access isiyotarajiwa kwa keys za `mfst|` / `git-refs|`.
- Badilisha Argo CD local users, project tokens, repository credentials na cluster credentials baada ya compromise.

Useful commands:
```bash
kubectl get networkpolicy -n argocd
kubectl get networkpolicy -A | grep -i argocd
kubectl describe networkpolicy -n argocd argocd-repo-server-network-policy 2>/dev/null
kubectl describe networkpolicy -n argocd argocd-redis-network-policy 2>/dev/null
```
## Dokezo la Static Analysis: Typed API Requests katika CodeQL

Kwa Go services zinazotumia gRPC/REST handlers, default CodeQL remote sources zinaweza kukosa flows baada ya raw input ku-unmarshaled kuwa typed request objects. Model muhimu kwa services za mtindo wa Argo CD ni:

- Receiver type kama vile `Server` au `Service`.
- Parameter ya kwanza ni `context.Context`.
- Parameter ya pili ni typed request object.

Model parameter hiyo ya pili kama remote source na ongeza custom sinks kwa arguments za `exec.Command` / `exec.CommandContext`. Hii husaidia kupata flows kutoka internal API request fields kwenda kwa command execution helpers.

## Marejeo

- [Synacktiv - Caught in the Octopus Trap: Unauthenticated RCE in Argo CD with CodeQL](https://www.synacktiv.com/en/publications/caught-in-the-octopus-trap-unauthenticated-rce-in-argo-cd-with-codeql)
- [Argo CD docs - Security considerations](https://argo-cd.readthedocs.io/en/stable/operator-manual/security/)
- [Argo CD docs - High Availability](https://argo-cd.readthedocs.io/en/stable/operator-manual/high_availability/)
- [Argo CD docs - repo-server command reference](https://argo-cd.readthedocs.io/en/stable/operator-manual/server-commands/argocd-repo-server/)
- [Argo CD - repo-server NetworkPolicy manifest](https://github.com/argoproj/argo-cd/blob/master/manifests/base/repo-server/argocd-repo-server-network-policy.yaml)
- [Argo CD docs - metrics](https://argo-cd.readthedocs.io/en/latest/operator-manual/metrics/)
- [Argo Helm - chart values reference](https://github.com/argoproj/argo-helm/blob/main/charts/argo-cd/README.md)
- [Kustomize - Helm chart generator example](https://github.com/kubernetes-sigs/kustomize/blob/master/examples/chart.md)
{{#include ../banners/hacktricks-training.md}}