hacktricks-cloud/src/pentesting-ci-cd/argocd-security.md

Usalama wa Argo CD

{{#include ../banners/hacktricks-training.md}}

Taarifa za Msingi

Argo CD ni jukwaa la GitOps continuous delivery kwa Kubernetes. Hufuatilia Git repositories, hutengeneza Kubernetes manifests kwa kutumia tools kama vile Helm, Kustomize, Jsonnet au config management plugins, na husawazisha hali halisi ya cluster na hali inayotakiwa iliyohifadhiwa kwenye Git.

Kwa mtazamo wa attacker, ichukulie Argo CD kama deployment engine yenye Kubernetes credentials. Argo CD ikicompromise inaweza kusababisha:

• Access kwa private Git repositories na repository credentials.
• Access kwa Kubernetes cluster secrets zinazotumiwa na Argo CD.
• Code execution ya manifest generation ndani ya argocd-repo-server.
• Deployment isiyoidhinishwa ya Kubernetes objects kupitia trusted Git repositories, Argo CD applications au cache manipulation.

Architecture na Components Muhimu

Kubernetes objects na services za kawaida:

kubectl get pods,svc,endpoints,ingress -A | grep -iE 'argocd|argo-cd'
kubectl get applications,appprojects,applicationsets -A 2>/dev/null
kubectl get secrets,configmaps -n argocd 2>/dev/null
kubectl get networkpolicy -n argocd 2>/dev/null

Huduma muhimu:

• argocd-server: API ya umma, web UI, CLI API, authentication na authorization.
• argocd-application-controller: hulinganisha hali inayotarajiwa na hali halisi, kisha hutumia resources kwenye Kubernetes.
• argocd-repo-server: hu-clone repositories, huhifadhi Git data kwenye cache, na huendesha Helm/Kustomize/Jsonnet/plugins ili kutengeneza manifests. Port ya default ya gRPC ni 8081.
• argocd-redis: cache ya application, manifest na Git reference data. Port ya default ya Redis ni 6379.
• argocd-applicationset-controller: hutengeneza Argo CD Application objects kutoka kwa generators kama Git, SCM, clusters na pull requests.

Kutoka kwenye pod iliyo-compromise au internal network segment, kagua internal reachability:

nc -vz <argocd-server> 443
nc -vz <argocd-repo-server> 8081
nc -vz <argocd-redis> 6379

Mashambulizi ya Public API / UI

Ikiwa una credentials za Argo CD au instance iliyo wazi, anza na API surface ya kawaida:

argocd login <argocd-server>
argocd account get-user-info
argocd account list
argocd proj list
argocd app list
argocd repo list
argocd cluster list
argocd admin settings rbac can <subject> <action> <resource> <object>

Njia muhimu za attack:

• Application write access: badilisha source.repoURL, source.path, thamani za Helm, chaguo za Kustomize, mipangilio ya plugin au chaguo za sync ili Argo CD ideploy manifests zinazodhibitiwa na mshambuliaji.
• Project misconfiguration: objects za AppProject zinaweza kuruhusu sourceRepos pana, destinations pana, clusterResourceWhitelist isiyo salama au vizuizi dhaifu vya namespace.
• Repository credential abuse: secrets za repository, credentials za GitHub App, SSH keys na tokens zinaweza kuruhusu kusukuma mabadiliko kwenye repos zinazoaminika au kuongeza dependencies hasidi.
• Cluster credential abuse: secrets za cluster zinaweza kuwa na bearer tokens au usanidi wa exec-provider unaotumiwa na Argo CD kufanya deploy kwenye target clusters.
• Local admin / project tokens: Argo CD tokens za muda mrefu zinaweza kutumiwa tena kupitia API isipokuwa zifutwe au zi-expire.

Enumerate usanidi kutoka Kubernetes unapokuwa na cluster read access:

kubectl get applications.argoproj.io -A -o yaml
kubectl get appprojects.argoproj.io -A -o yaml
kubectl get applicationsets.argoproj.io -A -o yaml
kubectl get secrets -n argocd -o yaml | grep -nE 'repoURL|sshPrivateKey|password|bearerToken|githubApp|tlsClientCertData|tlsClientCertKey'
kubectl get cm -n argocd argocd-cm argocd-rbac-cm argocd-cmd-params-cm -o yaml

Matumizi Mabaya ya Git Repository Inayoaminika

Ikiwa unaweza kufanya push kwenye repository inayoaminika na Argo CD, kwa kawaida unaweza kuathiri kitakachodeployiwa. Athari hutegemea mipaka ya AppProject na permissions za service account zinazotumiwa na application controller.

Maeneo ya kawaida ya payload:

• Raw Kubernetes YAML chini ya application path.
• Helm chart templates na values.yaml.
• Kustomize overlays, remote bases na generators.
• Jsonnet au input ya config management plugin.
• ApplicationSet generator files zinazounda au kusasisha objects za Application.

Kagua ikiwa app inatumia automated sync, pruning, self-heal, sync windows au manual approvals:

kubectl get applications.argoproj.io -A \
-o custom-columns='NS:.metadata.namespace,APP:.metadata.name,PROJECT:.spec.project,AUTOSYNC:.spec.syncPolicy.automated,REPO:.spec.source.repoURL,PATH:.spec.source.path,DEST:.spec.destination.server'

Abuse ya moja kwa moja ya argocd-repo-server

Usidhani kuwa Argo CD API ya umma ndiyo attack surface pekee. Vipengele vya ndani vya Argo CD huwasiliana na argocd-repo-server kupitia gRPC. Ikiwa pods holela zinaweza kufikia repo-server, requests za ndani zinazodhibitiwa na attacker zinaweza kukwepa ukaguzi unaotekelezwa kwa kawaida na argocd-server.

Ukaguzi wa vitendo:

kubectl get svc -n argocd argocd-repo-server -o yaml
kubectl get endpoints -n argocd argocd-repo-server -o wide
nc -vz <argocd-repo-server> 8081

Dalili muhimu:

• Endpoint ya gRPC ya repo-server inafikika kutoka kwa pods zisizo za Argo CD.
• NetworkPolicies hazipo, au zinaruhusu tu egress bila kuzuia ingress.
• Repo-server ina ufikiaji wa custom config management plugins, zana za decryption, au maudhui ya repository kutoka kwa tenants wengi.
• Redis inafikika kutoka kwa pods zisizo za Argo CD, hivyo kuruhusu ukaguzi au tampering ya cache ikiwa credentials zinapatikana au hazihitajiki.

Unauthenticated Repo-Server RCE via Kustomize Options

Mnamo Julai 2026, Synacktiv ilifichua code execution chain isiyohitaji authentication katika repo-server ya Argo CD, wakati mshambuliaji anaweza kufikia internal gRPC service. Shambulio hili hutumia vibaya ufikiaji wa moja kwa moja wa /repository.RepoServerService/GenerateManifest pamoja na KustomizeOptions zinazodhibitiwa na mshambuliaji.

Primitive hatari ni kulazimisha repo-server ku-clone maudhui ya repository yanayodhibitiwa na mshambuliaji na kuendesha Kustomize ikiwa na support ya Helm:

kustomize build <attacker_repo_path> --enable-helm --helm-command ./payload.sh

Input ndogo hasidi ya Kustomize inahitaji kuchochea uchakataji wa Helm:

helmCharts:
- name: pwn
version: 0.0.1

Kwa nini hii inafanya kazi:

• argocd-repo-server hu-clone repository kabla ya ku-render.
• --helm-command ./payload.sh hutatuliwa ikiwa relative kwa repository iliy-clone.
• Code execution haihitaji shell metacharacter injection ikiwa attacker anaweza kudhibiti repository iliy-render na chaguo za Kustomize build.

Wakati wa disclosure ya Synacktiv ya Julai 1, 2026, waliripoti kwamba issue hiyo haikuwa na official fix wala CVE. Ichukulie kwanza kama issue ya network exposure: exploitation inahitaji kufikika kwa internal repo-server gRPC port.

Redis Cache Poisoning ya Ku-deploy Manifests

Baada ya code execution katika argocd-repo-server, au baada ya kupata direct access kwa Redis kwa valid credentials, kagua cache entries zinazotumia Redis. Argo CD kwa kawaida huhifadhi values za JSON zilizobanwa kwa gzip.

Key prefixes zinazovutia:

mfst|...       # cached rendered manifests
git-refs|...   # Git branch/ref to commit mappings
app|...        # application resource/cache data
cluster|...    # cluster cache information

The cache poisoning attack iliyoelezwa na Synacktiv hutumia sehemu mbili za state:

1. Rekebisha cache entry husika ya mfst|... ili ijumuishwe Kubernetes manifest inayodhibitiwa na attacker.
2. Rekebisha mapping inayohusiana ya git-refs|... ili Argo CD iamini kuwa branch imehamishwa, kisha ifanye reconcile kurudi kwenye revision iliyo kwenye cache.

Impact:

• Auto Sync ikiwa imewashwa, Argo CD inaweza kutumia poisoned cached manifest automatically.
• Bila Auto Sync, payload bado inaweza kutumika wakati user anafanya sync ya application manually.
• Impact ya mwisho inawekewa kikomo na destination ya target application pamoja na Kubernetes permissions zinazopatikana kwa Argo CD.

ApplicationSet Attacks

ApplicationSet ni nyeti hasa kwa sababu huunda au kusasisha Application objects kutokana na generator output.

Review:

kubectl get applicationsets.argoproj.io -A -o yaml
kubectl get appprojects.argoproj.io -A -o yaml

Mifumo ya kuvutia:

• Git generators zinazosoma files zinazoweza kuandikwa na attacker, zinazodhibiti majina ya apps, paths, projects au destinations.
• Pull request generators za public repositories ambapo contributors wasioaminika wanaweza kushawishi applications zinazozalishwa.
• Template fields zinazoruhusu destination clusters/namespaces pana.
• AppProjects zinazoruhusu sourceRepos: ["*"] au destinations pana.
• Applications zinazozalishwa ambazo hurithi automated sync na pruning.

Post-Exploitation

Kutoka kwenye pod shell ya Argo CD, prioritise:

env
cat /proc/1/environ 2>/dev/null | tr '\0' '\n'
find /var/run/secrets /app/config -type f -maxdepth 4 2>/dev/null
mount | grep -E 'secret|token|config'

Malengo muhimu:

• Kuiba REDIS_PASSWORD au TLS/client material ya Redis.
• Kutoa repository credentials kutoka kwenye secrets zilizomountiwa au Argo CD Kubernetes secrets.
• Kutambua cluster credentials zinazotumiwa na Argo CD.
• Kusoma generated manifests na plugin output ambazo zinaweza kujumuisha injected secrets.
• Kuangalia kama custom plugins, SOPS, Helm secrets, Vault plugins au cloud CLIs zinafichua decryption keys na cloud credentials.

Detection & Hardening

Ukaguzi muhimu:

• Zuia argocd-repo-server port 8081 na Redis port 6379 kwa kutumia NetworkPolicies, ili vipengele vya Argo CD vinavyotarajiwa pekee viweze kuzifikia.
• Katika Helm deployments, thibitisha kuwa network policies zinaundwa kweli. Argo CD Helm chart values kihistoria zimeweka component network policy creation kuwa disabled kwa default.
• Weka argocd-server kama authenticated entry point. Internal services hazipaswi kufikiwa kutoka kwa arbitrary workloads.
• Zima config management tools na plugins zisizotumika.
• Zuia AppProject sourceRepos, destinations, namespace permissions na cluster-scoped resources.
• Epuka kuhifadhi broad repository credentials mahali ambapo Argo CD user mwenye low privilege anaweza kusababisha zitumike tena.
• Fuatilia repo-server requests, Kustomize build options, plugin executions, Redis writes na access isiyotarajiwa kwa keys za mfst| / git-refs|.
• Badilisha Argo CD local users, project tokens, repository credentials na cluster credentials baada ya compromise.

Useful commands:

kubectl get networkpolicy -n argocd
kubectl get networkpolicy -A | grep -i argocd
kubectl describe networkpolicy -n argocd argocd-repo-server-network-policy 2>/dev/null
kubectl describe networkpolicy -n argocd argocd-redis-network-policy 2>/dev/null

Dokezo la Static Analysis: Typed API Requests katika CodeQL

Kwa Go services zinazotumia gRPC/REST handlers, default CodeQL remote sources zinaweza kukosa flows baada ya raw input ku-unmarshaled kuwa typed request objects. Model muhimu kwa services za mtindo wa Argo CD ni:

• Receiver type kama vile Server au Service.
• Parameter ya kwanza ni context.Context.
• Parameter ya pili ni typed request object.

Model parameter hiyo ya pili kama remote source na ongeza custom sinks kwa arguments za exec.Command / exec.CommandContext. Hii husaidia kupata flows kutoka internal API request fields kwenda kwa command execution helpers.

Marejeo

• Synacktiv - Caught in the Octopus Trap: Unauthenticated RCE in Argo CD with CodeQL
• Argo CD docs - Security considerations
• Argo CD docs - High Availability
• Argo CD docs - repo-server command reference
• Argo CD - repo-server NetworkPolicy manifest
• Argo CD docs - metrics
• Argo Helm - chart values reference
• Kustomize - Helm chart generator example {{#include ../banners/hacktricks-training.md}}