Penetration Test Report (TrailOfBits): argo security final report

Argo
Security Assessment
March 12, 2021
Prepared For:
Edward Lee | I​ ntuit Chris Aniszczyk | ​Linux Foundation
edward_lee@intuit.com caniszczyk@linuxfoundation.org
Alex Collins | ​Intuit Jesse Suen | ​Intuit
alex_collins@intuit.com jesse_suen@intuit.com
Alexander Matyushentsev | I​ ntuit Henrik Blixt | I​ ntuit
alexander_matyushentsev@intuit.com henrik_blixt@intuit.com
Prepared By:
Dominik Czarnota | T​ rail of Bits David Pokora | ​Trail of Bits
dominik.czarnota@trailofbits.com david.pokora@trailofbits.com
Mike Martel | ​Trail of Bits
mike.martel@trailofbits.com
Executive Summary
Project Dashboard
Engagement Goals
Coverage
Recommendations Summary
Short Term
Long Term
Findings Summary
1. Redis is outdated
2. Redis does not leverage passphrases
3. Redis does not leverage TLS encryption
4. Lack of container security options
5. Rollouts: Unhandled error when reconciling Istio Virtual Service
6. Unhandled deferred file close operations
7. MinIO container runs as root
8. File extension comparisons are case sensitive
9. Workflows: HTTP used by default for Web UI
10. Weak TLS version/cipher mode configurations
11. Workflows: HTTP artifact fetcher will fail on self-signed certificates
12. Workflows: HTTP artifact fetcher will not use TLS by default
13. Prometheus metrics endpoints do not use TLS
14. Workflows: Git artifact fetcher does not validate revision names
15. Rollouts: Use of strconv.Atoi when a fixed-width integer is desired
16. The zJWT auth tokens allow for denial of service in Argo CD
17. Non-cryptographically secure random function documented as CSPRNG
18. Symlink in a Git repository allows including files outside of the Git repository path on
the Argo CD repo server
19. Providing repository URL in the app creation form clones the repo even if the app is
not created
20. Incorrect logging of command arguments in the RunCommandExt convenience
function
21. An application path may contain path traversal payload that ends up in the
application's resulting path
22. Argo CD CLI suggests that it is possible to create the same application twice
23. Argo CD file descriptor leak that may lead to exhausting opened file descriptor limit
24. Argo CD contributing guide suggests adding user to the docker group without
explaining its security risks
© 2021 Trail of Bits Argo Security Assessment | 1
25. Argo CD command line does not warn about too broad permissions of Argo token
file
26. Argo CD website lacks Content Security Policy and uses the X-XSS-Protection: 1
header
27. Argo Events authentication token generated using weak PRNG
28. Argo Events NATS streaming service does not use TLS by default
29. Argo CD may return an incorrect error message for a missing claim in the numField
function
30. Argo CD: the getToken function parses multiple tokens instead of using the first
valid one
31. The WaitPID function is vulnerable to a PID-reuse attack
32. Argo CD Web UI does not support changing local admin password
33. Argo CD does not invalidate token for local admin on logout
34. Argo projects do not provide documentation for release cycle
35. Packages with security vulnerabilities in Argo-CD and Argo Workflows UI
A. Vulnerability Classifications
B. Hardening containers run via Kubernetes
Root inside container
Dropping Linux capabilities
NoNewPrivs flag
Seccomp policies
Linux Security Module (AppArmor)
© 2021 Trail of Bits Argo Security Assessment | 2
Executive Summary
From March 1 to March 9, 2021, Trail of Bits conducted a code review of the Argo product
suite, including Argo CD, Argo Workflows, Argo Rollouts, and Argo Events.
Trail of Bits security engineers used the first week to employ static analysis tools such as
Semgrep, g​ osec, ​CodeQL, and e​ rrcheck, in addition to conducting a preliminary manual
​ ​ ​ ​
review. Manual review efforts included investigations into insufficient use of cryptography
and data validation, improper handling or assignment of access controls, weak
configurations, potential information disclosures, incorrect or dangerous use of auditing
and logging, and resource exhaustion attacks. The primary targets of these manual review
efforts included Argo CD and Argo Workflows. This review resulted in 23 findings ranging
from undetermined to medium severity, as well as several untriaged concerns.
The final week of review included two calendar days of effort. In addition to conducting a
deeper review into the above mentioned classes of issues, Trail of Bits triaged remaining
suspicions identified in the previous week. During the remainder of the audit, Trail of Bits
placed increased emphasis on Argo Events and Argo Rollouts while generally reviewing
concerns regarding insufficient use of authentication, file permissions, Kubernetes best
practices, undefined behavior stemming from a lack of documentation or insufficient error
handling, race conditions, and general data validation concerns. This resulted in 12
additional findings ranging from medium to informational severity.
Overall, services in the Argo product suite often do well in leveraging platform-specific
features such as Kubernetes secrets to manage sensitive data and take into consideration
attempts by external attackers to gain access. However, consider the following when
moving forward in the development process:
● The Argo product suite could benefit from consideration of additional scenarios that
could arise when an attacker gains access to the internal network through some
component.
● Connections between internal components or components in the default setup
environment commonly lack encryption and authentication (​TOB-ARGO-002,​
TOB-ARGO-003,​ ​TOB-ARGO-009,​ ​TOB-ARGO-012,​ ​TOB-ARGO-013,​ ​TOB-ARGO-028)​ .
● In general, it may be worth reviewing cryptography best practices, given the use of
insecure random number generators and cipher suites (T​ OB-ARGO-010,​
TOB-ARGO-017,​ ​TOB-ARGO-027)​ .
● Additional emphasis on error handling may be valuable (​TOB-ARGO-005,​
TOB-ARGO-006,​ ​TOB-ARGO-011,​ ​TOB-ARGO-022,​ ​TOB-ARGO-023,​ ​TOB-ARGO-029)​ .
● Similarly, increased focus on data validation may prevent a number of issues
(T​ OB-ARGO-008,​ ​TOB-ARGO-014,​ ​TOB-ARGO-015,​ ​TOB-ARGO-016,​ ​TOB-ARGO-018,​
TOB-ARGO-021,​ ​TOB-ARGO-030)​ .
© 2021 Trail of Bits Argo Security Assessment | 3
● Hardening the deployment configuration may mitigate privilege escalation attempts
if an attacker gains access to one of the containers (​TOB-ARGO-004,​ ​Appendix B:
Hardening containers run via Kubernetes​).
Trail of Bits recommends addressing the findings in this report, including the short- and
long-term recommendations. After applying the fixes and considering the
recommendations, perform an assessment to ensure that the fixes are adequate and do
not introduce additional security risks. We also recommend performing a further
assessment focusing on the areas listed in the C​ overage ​section that we weren't able to
penetrate deeply due to time constraints and the large scope of the audit.
© 2021 Trail of Bits Argo Security Assessment | 4
Project Dashboard
Application Summary
Name Argo
Version argo-cd c6d3728
argo-events 6ed9e47
argo-rollouts dff1f22
argo-workflows e6fa41a
gitops-engine aae8ded
pkg 52727e4
Type Go
Platforms Linux
Engagement Summary
Dates March 1 – 9, 2021
Method Whitebox
Consultants Engaged 3
Level of Effort 3 person-weeks
Vulnerability Summary
Total High-Severity Issues 0
Total Medium-Severity Issues 3 ◼◼◼
Total Low-Severity Issues 16 ◼◼◼◼◼◼◼◼◼◼◼◼◼◼◼◼
Total Informational-Severity Issues 16 ◼◼◼◼◼◼◼◼◼◼◼◼◼◼◼◼
Total Undetermined-Severity Issues 0
Total 35
Category Breakdown
Access Controls 2 ◼◼
Configuration 11 ◼◼◼◼◼◼◼◼◼◼◼
Cryptography 3 ◼◼◼
Data Validation 5 ◼◼◼◼◼
© 2021 Trail of Bits Argo Security Assessment | 5
Denial of Service 3 ◼◼◼
Documentation 1 ◼
Error Reporting 3 ◼◼◼
Patching 3 ◼◼◼
Timing 1 ◼
Undefined Behavior 3 ◼◼◼
Total 35
© 2021 Trail of Bits Argo Security Assessment | 6
Engagement Goals
The engagement was scoped to provide a security assessment of the Argo product