Symlink following allows leaking out-of-bound manifests and JSON files from Argo CD repo-server

{
  "id": "711f0841d63a06a83e519afc288dc4f2cdad614abb472e4778118b853aef639f",
  "url": "https://osv.dev/vulnerability/GHSA-6gcg-hp2x-q54h",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Symlink following allows leaking out-of-bound manifests and JSON files from Argo CD repo-server",
    "summary": "### Impact All unpatched versions of Argo CD starting with v0.7.0 are vulnerable to a symlink following bug allowing a malicious user with repository write access to leak sensitive files from Argo CD's repo-server. A malicious Argo CD user with write access for a repository which is (or may be) used in a directory-type Application may commit a symlink which points to an out-of-bounds file. * If the target file is a valid JSON or YAML manifest file, and the resource is allowed in the Application, the attacker can read the contents of that manifest file. (In versions <2.3.2, <2.2.8, and <2.1.14, the attacker may read the files contents even if the resource is _not_ allowed in the Application). * If the target file is valid JSON but is _not_ a manifest file, the attacker may read the contents of the file. * If the target file is not valid JSON or YAML, the attacker may read partial file contents (usually just the first character of the file). Sensitive files which could be leaked include manifest files from other Applications' source repositories (potentially decrypted files, if you are using a decryption plugin) or any JSON-formatted secrets which have been mounted as files on the repo-server. ### Patches A patch for this vulnerability has been released in the following Argo CD versions: * v2.3.4 * v2.2.9 * v2.1.15 ### Workarounds * If you are using >=v2.3.0 and do not have any Jsonnet/directory-type Applications, [disable the Jsonnet/directory config management tool](https://a",
    "evidence": "osv:GHSA-6gcg-hp2x-q54h",
    "products": [
      {
        "name": {
          "value": "github.com/argoproj/argo-cd/v2",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "2.1.15",
            "evidence": "/affected/0/ranges"
          }
        ],
        "affected_versions": []
      },
      {
        "name": {
          "value": "github.com/argoproj/argo-cd/v2",
          "evidence": "/affected/1/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "2.2.9",
            "evidence": "/affected/1/ranges"
          }
        ],
        "affected_versions": []
      },
      {
        "name": {
          "value": "github.com/argoproj/argo-cd/v2",
          "evidence": "/affected/2/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "2.3.4",
            "evidence": "/affected/2/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "medium",
    "structured": {
      "id": "GHSA-6gcg-hp2x-q54h",
      "aliases": [
        "CVE-2022-24904",
        "GHSA-6gcg-hp2x-q54h",
        "GO-2022-0453"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "SEMVER",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "2.1.15"
                }
              ]
            }
          ],
          "package": {
            "name": "github.com/argoproj/argo-cd/v2",
            "purl": "pkg:golang/github.com/argoproj/argo-cd/v2",
            "ecosystem": "Go"
          },
          "database_specific": {
            "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-6gcg-hp2x-q54h/GHSA-6gcg-hp2x-q54h.json"
          }
        },
        {
          "ranges": [
            {
              "type": "SEMVER",
              "events": [
                {
                  "introduced": "2.2.0"
                },
                {
                  "fixed": "2.2.9"
                }
              ]
            }
          ],
          "package": {
            "name": "github.com/argoproj/argo-cd/v2",
            "purl": "pkg:golang/github.com/argoproj/argo-cd/v2",
            "ecosystem": "Go"
          },
          "database_specific": {
            "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-6gcg-hp2x-q54h/GHSA-6gcg-hp2x-q54h.json"
          }
        },
        {
          "ranges": [
            {
              "type": "SEMVER",
              "events": [
                {
                  "introduced": "2.3.0"
                },
                {
                  "fixed": "2.3.4"
                }
              ]
            }
          ],
          "package": {
            "name": "github.com/argoproj/argo-cd/v2",
            "purl": "pkg:golang/github.com/argoproj/argo-cd/v2",
            "ecosystem": "Go"
          },
          "database_specific": {
            "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-6gcg-hp2x-q54h/GHSA-6gcg-hp2x-q54h.json"
          }
        }
      ],
      "modified": "2026-10-21T03:11:56.153993529Z",
      "provider": "osv",
      "references": [
        "https://github.com/argoproj/argo-cd/security/advisories/GHSA-6gcg-hp2x-q54h",
        "https://nvd.nist.gov/vuln/detail/CVE-2022-24904",
        "https://github.com/argoproj/argo-cd/commit/5e767a4b9e30983330c0fdec322192281a90eb84",
        "https://github.com/argoproj/argo-cd/commit/7357cfdb58a560de70a0538c6e3bef6fe39505ea",
        "https://github.com/argoproj/argo-cd/commit/d36d95dc9f71ec61c1a93794f81ece6d61a0d943",
        "https://github.com/argoproj/argo-cd/releases/tag/v2.1.15",
        "https://github.com/argoproj/argo-cd/releases/tag/v2.2.9",
        "https://github.com/argoproj/argo-cd/releases/tag/v2.3.4"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-59",
          "CWE-61"
        ],
        "severity": "MODERATE",
        "github_reviewed": true,
        "nvd_published_at": "2022-05-20T14:15:00Z",
        "github_reviewed_at": "2022-05-23T21:13:57Z"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2022-24904",
        "evidence": "/aliases"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 391580,
  "published_at": "2022-05-23T21:13:57+00:00"
}