CVE-2024-21662
Argo CD vulnerable to Bypassing of Rate Limit and Brute Force Protection Using Cache Overflow
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to versions 2.8.13, 2.9.9, and 2.10.4, an attacker can effectively bypass the rate limit and brute force protections by exploiting the application's weak cache-based mechanism. This loophole in security can be combined with other vulnerabilities to attack the default admin account. This flaw undermines a patch for CVE-2020-8827 intended to protect against brute-force attacks. The application's brute force protection relies on a cache mechanism that tracks login attempts for each user. This cache is limited to a `defaultMaxCacheSize` of 1000 entries. An attacker can overflow this cache by bombarding it with login attempts for different users, thereby pushing out the admin account's failed attempts and effectively resetting the rate limit for that account. This is a severe vulnerability that enables attackers to perform brute force attacks at an accelerated rate, especially targeting the default admin account. Users should upgrade to version 2.8.13, 2.9.9, or 2.10.4 to receive a patch.
Argo CD es una herramienta declarativa de entrega continua de GitOps para Kubernetes. Antes de las versiones 2.8.13, 2.9.9 y 2.10.4, un atacante podía eludir eficazmente el límite de velocidad y las protecciones de fuerza bruta explotando el débil mecanismo basado en caché de la aplicación. Esta laguna de seguridad se puede combinar con otras vulnerabilidades para atacar la cuenta de administrador predeterminada. Esta falla socava un parche para CVE-2020-8827 destinado a proteger contra ataques de fuerza bruta. La protección de fuerza bruta de la aplicación se basa en un mecanismo de caché que rastrea los intentos de inicio de sesión de cada usuario. Este caché está limitado a un `defaultMaxCacheSize` de 1000 entradas. Un atacante puede desbordar este caché bombardeándolo con intentos de inicio de sesión para diferentes usuarios, eliminando así los intentos fallidos de la cuenta de administrador y restableciendo efectivamente el límite de velocidad para esa cuenta. Se trata de una vulnerabilidad grave que permite a los atacantes realizar ataques de fuerza bruta a un ritmo acelerado, especialmente dirigidos a la cuenta de administrador predeterminada. Los usuarios deben actualizar a la versión 2.8.13, 2.9.9 o 2.10.4 para recibir un parche.
A flaw was found in Argo CD, where the rate limit for login attempts may be bypassed due to an incomplete fix for CVE-2020-8827. The cache-based mechanism is limited to a `defaultMaxCacheSize` of 1000 entries. An attacker can overflow this cache by sending excessive login attempts for different users, thereby pushing out the admin account's failed attempts and effectively resetting the rate limit for that account. This enables attackers to perform brute force attacks at an accelerated rate, especially targeting the default admin account.
CVSS Scores
SSVC
- Decision:Attend
Timeline
- 2023-12-29 CVE Reserved
- 2024-03-18 CVE Published
- 2024-03-19 EPSS Updated
- 2024-08-01 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-307: Improper Restriction of Excessive Authentication Attempts
CAPEC
References (7)
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2024-21662 | 2024-04-10 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2270182 | 2024-04-10 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Argoproj Search vendor "Argoproj" | Argo-cd Search vendor "Argoproj" for product "Argo-cd" | < 2.8.13 Search vendor "Argoproj" for product "Argo-cd" and version " < 2.8.13" | en |
Affected
| ||||||
| Argoproj Search vendor "Argoproj" | Argo-cd Search vendor "Argoproj" for product "Argo-cd" | >= 2.9.0 < 2.9.9 Search vendor "Argoproj" for product "Argo-cd" and version " >= 2.9.0 < 2.9.9" | en |
Affected
| ||||||
| Argoproj Search vendor "Argoproj" | Argo-cd Search vendor "Argoproj" for product "Argo-cd" | >= 2.10.0 < 2.10.4 Search vendor "Argoproj" for product "Argo-cd" and version " >= 2.10.0 < 2.10.4" | en |
Affected
| ||||||