« Volver al listado

CVE-2024-52799

Estado: AplazadaAlta (8.2)—

Argo Workflows Chart is used to set up argo and its needed dependencies through one command. Prior to 0.44.0, the workflow-role has excessive privileges, the worst being create pods/exec, which will allow kubectl exec into any Pod in the same namespace, i.e. arbitrary code execution within those Pods. If a user can be made to run a malicious template, their whole namespace can be compromised. This affects versions of the argo-workflows Chart that use appVersion: 3.4 and above, which no longer need these permissions for the only available Executor, Emissary. It could also affect users below 3.4 depending on their choice of Executor in those versions. This only affects the Helm Chart and not the upstream manifests. This vulnerability is fixed in 0.44.0.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

UI:R (interacción del usuario) ejecuta plantilla maliciosa; escalada por permisos excesivos (create pods/exec); ejecución arbitraria de código en pods del namespace.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Execution PreventionApplication Isolation and SandboxingExploit ProtectionUpdate SoftwareThreat Intelligence ProgramRestrict Web-Based Content

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Argo — Argo Workflows ChartAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-52799",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-52799",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-11-21T20:41:34.058031Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 8.2,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 1.5
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "argoproj",
          "product": "argo-helm",
          "versions": [
            {
              "status": "affected",
              "version": "< 0.44.0"
            }
          ]
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:argoproj:argo-helm:*:*:*:*:*:*:*:*"
          ],
          "vendor": "argoproj",
          "product": "argo-helm",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "0.44.0",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-11-21T17:15:24.220",
  "references": [
    {
      "url": "https://github.com/argoproj/argo-helm/commit/81dc44c4a5ccd42c799469a78eb96a68048a4987",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/argoproj/argo-helm/security/advisories/GHSA-fgrf-2886-4q7m",
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-250"
        },
        {
          "lang": "en",
          "value": "CWE-1220"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Argo Workflows Chart is used to set up argo and its needed dependencies through one command. Prior to 0.44.0, the workflow-role has excessive privileges, the worst being create pods/exec, which will allow kubectl exec into any Pod in the same namespace, i.e. arbitrary code execution within those Pods. If a user can be made to run a malicious template, their whole namespace can be compromised. This affects versions of the argo-workflows Chart that use appVersion: 3.4 and above, which no longer need these permissions for the only available Executor, Emissary. It could also affect users below 3.4 depending on their choice of Executor in those versions. This only affects the Helm Chart and not the upstream manifests. This vulnerability is fixed in 0.44.0."
    },
    {
      "lang": "es",
      "value": "El diagrama de flujos de trabajo de Argo se utiliza para configurar Argo y sus dependencias necesarias a través de un comando. Antes de la versión 0.44.0, el rol de flujo de trabajo tiene privilegios excesivos, el peor de los cuales es create pods/exec, que permitirá que kubectl exec ingrese a cualquier Pod en el mismo espacio de nombres, es decir, la ejecución de código arbitrario dentro de esos Pods. Si se puede obligar a un usuario a ejecutar una plantilla maliciosa, se puede comprometer todo su espacio de nombres. Esto afecta a las versiones del diagrama de flujos de trabajo de Argo que usan appVersion: 3.4 y posteriores, que ya no necesitan estos permisos para el único Ejecutor disponible, Emissary. También podría afectar a los usuarios de versiones anteriores a la 3.4, según su elección de Ejecutor en esas versiones. Esto solo afecta al diagrama de Helm y no a los manifiestos ascendentes. Esta vulnerabilidad se corrigió en la versión 0.44.0."
    }
  ],
  "lastModified": "2026-06-17T08:07:38.977",
  "sourceIdentifier": "security-advisories@github.com"
}