hacktricks-cloud/src/pentesting-ci-cd/argocd-security.md

Argo CD Security

{{#include ../banners/hacktricks-training.md}}

Basic Information

Argo CD ni jukwaa la GitOps la continuous delivery kwa Kubernetes. Linafuatilia Git repositories, hutoa Kubernetes manifests kwa kutumia tools kama Helm, Kustomize, Jsonnet au config management plugins, na kusawazisha hali ya cluster iliyo hai na state lengwa iliyohifadhiwa kwenye Git.

Kutoka kwa mtazamo wa attacker, chukulia Argo CD kama deployment engine yenye Kubernetes credentials. Compromise yenye manufaa ya Argo CD inaweza kusababisha:

• Access kwa private Git repositories na repository credentials.
• Access kwa Kubernetes cluster secrets zinazotumiwa na Argo CD.
• Manifest generation code execution katika argocd-repo-server.
• Unauthorized Kubernetes object deployment kupitia trusted Git repositories, Argo CD applications, au cache manipulation.

Architecture & Interesting Components

Common Kubernetes objects and services:

kubectl get pods,svc,endpoints,ingress -A | grep -iE 'argocd|argo-cd'
kubectl get applications,appprojects,applicationsets -A 2>/dev/null
kubectl get secrets,configmaps -n argocd 2>/dev/null
kubectl get networkpolicy -n argocd 2>/dev/null

Huduma za kuvutia:

• argocd-server: public API, web UI, CLI API, authentication and authorization.
• argocd-application-controller: inalisha desired na live state, kisha inatumia resources kwa Kubernetes.
• argocd-repo-server: ina-clone repositories, ina-cache Git data, na inaendesha Helm/Kustomize/Jsonnet/plugins kutengeneza manifests. Default gRPC port ni 8081.
• argocd-redis: cache kwa application, manifest na Git reference data. Default Redis port ni 6379.
• argocd-applicationset-controller: inazalisha Argo CD Application objects kutoka kwa generators kama Git, SCM, clusters na pull requests.

Kutoka kwenye compromised pod au internal network segment, kagua internal reachability:

nc -vz <argocd-server> 443
nc -vz <argocd-repo-server> 8081
nc -vz <argocd-redis> 6379

Public API / UI Mashambulizi

Ikiwa una Argo CD credentials au instance iliyofichuliwa, anza na normal API surface:

argocd login <argocd-server>
argocd account get-user-info
argocd account list
argocd proj list
argocd app list
argocd repo list
argocd cluster list
argocd admin settings rbac can <subject> <action> <resource> <object>

Njia muhimu za attack:

• Application write access: rekebisha source.repoURL, source.path, Helm values, Kustomize options, plugin settings au sync options ili Argo CD idisploy manifests zinazodhibitiwa na attacker.
• Project misconfiguration: vitu vya AppProject vinaweza kuruhusu sourceRepos pana, destinations pana, clusterResourceWhitelist isiyo salama, au vizuizi dhaifu vya namespace.
• Repository credential abuse: repository secrets, GitHub App credentials, SSH keys na tokens zinaweza kuruhusu kusukuma kwenda trusted repos au kuongeza malicious dependencies.
• Cluster credential abuse: cluster secrets zinaweza kuwa na bearer tokens au exec-provider configuration zinazotumiwa na Argo CD ku-deploy kwenda target clusters.
• Local admin / project tokens: Argo CD tokens za muda mrefu zinaweza kutumika tena kupitia API isipokuwa zifutwe au ziishe muda wake.

Enumerate configuration from Kubernetes when you have cluster read access:

kubectl get applications.argoproj.io -A -o yaml
kubectl get appprojects.argoproj.io -A -o yaml
kubectl get applicationsets.argoproj.io -A -o yaml
kubectl get secrets -n argocd -o yaml | grep -nE 'repoURL|sshPrivateKey|password|bearerToken|githubApp|tlsClientCertData|tlsClientCertKey'
kubectl get cm -n argocd argocd-cm argocd-rbac-cm argocd-cmd-params-cm -o yaml

Matumizi Mabaya ya Trusted Git Repository

Ukipata uwezo wa push kwenye repository inayoaminika na Argo CD, kwa kawaida unaweza kuathiri kinachotumwa. Athari hutegemea mipaka ya AppProject na ruhusa za service account zinazotumiwa na application controller.

Sehemu za kawaida za kuweka payload:

• Raw Kubernetes YAML chini ya application path.
• Helm chart templates na values.yaml.
• Kustomize overlays, remote bases na generators.
• Jsonnet au config management plugin input.
• ApplicationSet generator files zinazounda au kusasisha Application objects.

Angalia kama app inatumia automated sync, pruning, self-heal, sync windows au manual approvals:

kubectl get applications.argoproj.io -A \
-o custom-columns='NS:.metadata.namespace,APP:.metadata.name,PROJECT:.spec.project,AUTOSYNC:.spec.syncPolicy.automated,REPO:.spec.source.repoURL,PATH:.spec.source.path,DEST:.spec.destination.server'

Matumizi mabaya ya moja kwa moja ya argocd-repo-server

Usidhani API ya umma ya Argo CD ndiyo tu attack surface. Vipengele vya ndani vya Argo CD huwasiliana na argocd-repo-server kupitia gRPC. Ikiwa pods za ndani zinaweza kufikia repo-server, maombi ya ndani yanayodhibitiwa na attacker yanaweza bypass checks ambazo kawaida hutekelezwa na argocd-server.

Ukaguzi wa vitendo:

kubectl get svc -n argocd argocd-repo-server -o yaml
kubectl get endpoints -n argocd argocd-repo-server -o wide
nc -vz <argocd-repo-server> 8081

Taarifa za kuvutia:

• Endpoint ya gRPC ya repo-server inafikiwa kutoka pods zisizo za Argo CD.
• NetworkPolicies hazipo au zinaruhusu tu egress kwa allow-list bila kuzuia ingress.
• repo-server ina access kwa custom config management plugins, decryption tools, au repository content kutoka kwa tenants wengi.
• Redis inafikiwa kutoka kwa pods zisizo za Argo CD, ikiruhusu inspection ya cache au tampering ikiwa credentials zinapatikana au hazihitajiki.

Unauthenticated Repo-Server RCE via Kustomize Options

Mnamo Julai 2026, Synacktiv ilifichua chain ya code execution isiyo na authentication katika repo-server ya Argo CD wakati mshambuliaji anaweza kufikia internal gRPC service. Shambulio linatumia direct access kwa /repository.RepoServerService/GenerateManifest na KustomizeOptions zinazodhibitiwa na mshambuliaji.

Primitive hatari ni kulazimisha repo-server ku-clone attacker-controlled repository content na kuendesha Kustomize na Helm support:

kustomize build <attacker_repo_path> --enable-helm --helm-command ./payload.sh

Ingizo la Kustomize lenye uovu la chini kabisa linahitajika ili kuchochea usindikaji wa Helm:

helmCharts:
- name: pwn
version: 0.0.1

Kwa nini hii inafanya kazi:

• argocd-repo-server hu-clone repository kabla ya rendering.
• --helm-command ./payload.sh hutatuliwa relative to the cloned repository.
• Code execution haihitaji shell metacharacter injection ikiwa attacker anaweza kudhibiti repository iliyorerenderiwa na Kustomize build options.

Wakati wa disclosure ya Synacktiv ya July 1, 2026, waliripoti kwamba issue hiyo haikuwa na fix rasmi wala CVE. Chukulia hili kwanza kama issue ya network-exposure: exploitation inahitaji reachability kwa internal repo-server gRPC port.

Redis Cache Poisoning to Deploy Manifests

Baada ya code execution katika argocd-repo-server, au baada ya direct access kwa Redis na valid credentials, kagua Redis-backed cache entries. Argo CD kwa kawaida huhifadhi gzip-compressed JSON values.

Interesting key prefixes:

mfst|...       # cached rendered manifests
git-refs|...   # Git branch/ref to commit mappings
app|...        # application resource/cache data
cluster|...    # cluster cache information

Shambulio la cache poisoning lililoelezewa na Synacktiv linatumia vipande viwili vya state:

1. Rekebisha entry ya cache ya manifest ya mfst|... husika ili ijumuishe Kubernetes manifest inayodhibitiwa na mshambuliaji.
2. Rekebisha mapping ya git-refs|... husika ili Argo CD iamini kuwa branch imehamia na kisha ifanye reconcile kurudi kwenye cached revision.

Impact:

• Ikiwa Auto Sync imewezeshwa, Argo CD inaweza kutumia poisoned cached manifest kiotomatiki.
• Bila Auto Sync, payload bado inaweza kutumika wakati user anasynchronise application kwa mkono.
• Impact ya mwisho inazuiliwa na destination ya application lengwa na Kubernetes permissions zinazopatikana kwa Argo CD.

ApplicationSet Attacks

ApplicationSet ni nyeti hasa kwa sababu huunda au husasisha Application objects kutoka kwenye output ya generator.

Review:

kubectl get applicationsets.argoproj.io -A -o yaml
kubectl get appprojects.argoproj.io -A -o yaml

Mitindo ya kuvutia:

• Git generators zinazosoma faili zinazoweza kuandikwa na mshambuliaji ambazo hudhibiti majina ya app, paths, projects au destinations.
• Pull request generators kwa public repositories ambapo contributors wasioaminika wanaweza kuathiri applications zinazozalishwa.
• Template fields zinazoruhusu broad destination clusters/namespaces.
• AppProjects zinazoruhusu sourceRepos: ["*"] au broad destinations.
• Generated applications zinazorithi automated sync na pruning.

Post-Exploitation

Kutoka kwenye Argo CD pod shell, prioritize:

env
cat /proc/1/environ 2>/dev/null | tr '\0' '\n'
find /var/run/secrets /app/config -type f -maxdepth 4 2>/dev/null
mount | grep -E 'secret|token|config'

Madhumuni muhimu:

• Iiba REDIS_PASSWORD au Redis TLS/client material.
• Toa repository credentials kutoka kwenye mounted secrets au Argo CD Kubernetes secrets.
• Tambua cluster credentials zinazotumiwa na Argo CD.
• Soma generated manifests na plugin output ambazo zinaweza kuwa na injected secrets.
• Angalia kama custom plugins, SOPS, Helm secrets, Vault plugins au cloud CLIs zinafichua decryption keys na cloud credentials.

Detection & Hardening

Ukaguzi muhimu:

• Zuia argocd-repo-server port 8081 na Redis port 6379 kwa kutumia NetworkPolicies ili ni Argo CD components zinazotarajiwa pekee ziweze kuifikia.
• Katika Helm deployments, hakikisha network policies zinaundwa kweli. Argo CD Helm chart values kihistoria zilikuwa na default ya component network policy creation kuwa disabled.
• Weka argocd-server kama authenticated entry point. Internal services hazipaswi kufikiwa na arbitrary workloads.
• Zima unused config management tools na plugins.
• Zuia AppProject sourceRepos, destinations, namespace permissions na cluster-scoped resources.
• Epuka kuhifadhi broad repository credentials mahali ambapo Argo CD user mwenye low privilege anaweza kusababisha zitumike tena.
• Fuatilia repo-server requests, Kustomize build options, plugin executions, Redis writes na unexpected access kwenye mfst| / git-refs| keys.
• Rotate Argo CD local users, project tokens, repository credentials na cluster credentials baada ya compromise.

Useful commands:

kubectl get networkpolicy -n argocd
kubectl get networkpolicy -A | grep -i argocd
kubectl describe networkpolicy -n argocd argocd-repo-server-network-policy 2>/dev/null
kubectl describe networkpolicy -n argocd argocd-redis-network-policy 2>/dev/null

Kumbuka ya Static Analysis: Typed API Requests katika CodeQL

Kwa Go services zinazotumia gRPC/REST handlers, default CodeQL remote sources zinaweza kukosa flows mara raw input inapokuwa imeshafanywa unmarshal kuwa typed request objects. Mfano unaofaa kwa huduma za Argo CD-style ni:

• Receiver type kama Server au Service.
• Kigezo cha kwanza ni context.Context.
• Kigezo cha pili ni typed request object.

Model hiyo kigezo cha pili kama remote source na ongeza custom sinks kwa argument za exec.Command / exec.CommandContext. Hii husaidia kupata flows kutoka kwenye internal API request fields kwenda kwenye command execution helpers.

References

• Synacktiv - Caught in the Octopus Trap: Unauthenticated RCE in Argo CD with CodeQL
• Argo CD docs - Security considerations
• Argo CD docs - High Availability
• Argo CD docs - repo-server command reference
• Argo CD - repo-server NetworkPolicy manifest
• Argo CD docs - metrics
• Argo Helm - chart values reference
• Kustomize - Helm chart generator example