Security researchers have discovered three critical vulnerabilities within Argo, a popular GitOps continuous delivery tool used in Kubernetes setups.
The vulnerabilities, identified by KTrust's in-house researchers, pose significant risks to system security, including bypassing rate limit and brute force protection mechanisms, triggering denial of service attacks and compromising user account safety.
The first vulnerability, CVE-2024-21662, involves bypassing rate limit and brute force protection by overloading the cache system, thereby resetting the protections and leaving the system vulnerable to attacks.
The second vulnerability, CVE-2024-21652, exploits a combination of weaknesses to bypass brute force protection through application crashes, resulting in the loss of in-memory data and allowing repeated login attempts without restriction.
The third vulnerability, CVE-2024-21661, presents a high-severity risk.
It allows for DoS attacks due to improper array manipulation in a multi-threaded environment.
According to Nadav Aharon-Nov, the CTO and co-founder of KTrust, the vulnerabilities were reported to Argo in September 2023.
Argo is reportedly planning to address these issues in an upcoming version of its product.
At the time of writing, despite contact attempts by Infosecurity, Argo has not provided an immediate response regarding these vulnerabilities.
Tactics to defend Kubernetes environments include implementing robust access controls, regularly updating software components, employing network segmentation and conducting regular security audits and assessments.
This Cyber News was published on www.infosecurity-magazine.com. Publication date: Mon, 18 Mar 2024 14:00:05 +0000