Summary
Argo CD's repo-server can process Jsonnet imports that escape the repository root, allowing readable files from the server environment to be exposed or causing excessive memory consumption. The risk is highest when an attacker can provide or commit a .jsonnet file that is evaluated during application manifest generation.
Argo CD's repo-server can process Jsonnet imports that escape the repository root, allowing readable files from the server environment to be exposed or causing excessive memory consumption. The risk is highest when an attacker can provide or commit a .jsonnet file that is evaluated during application manifest generation.
Affected context
The issue occurs in Argo CD deployments where the repo-server evaluates Jsonnet files for directory applications or manifest-generation requests. The importer may resolve absolute paths, parent-directory traversal, or repository symlinks without confining access to the application repository. Depending on authorization and workflow configuration, an attacker may be able to submit a file through the manifest upload interface or introduce one through a repository used by an Application.
The issue occurs in Argo CD deployments where the repo-server evaluates Jsonnet files for directory applications or manifest-generation requests. The importer may resolve absolute paths, parent-directory traversal, or repository symlinks without confining access to the application repository. Depending on authorization and workflow configuration, an attacker may be able to submit a file through the manifest upload interface or introduce one through a repository used by an Application.
Exploit preconditions
- Attack surface: Argo CD repo-server Jsonnet manifest evaluation
- Required access: Either repository write access, or access to an existing directory Application sufficient to use the manifest upload path; the described upload scenario requires Application get permission and does not require Application update or sync permission
- Trigger point: Manifest generation through application processing, server-side diff, or the application manifest upload endpoint
- Why exploitation is possible: Jsonnet import, importstr, and importbin operations are not reliably confined to the repository root, allowing access to readable paths and potentially unbounded input streams
- Attack surface: Argo CD repo-server Jsonnet manifest evaluation
- Required access: Either repository write access, or access to an existing directory Application sufficient to use the manifest upload path; the described upload scenario requires Application get permission and does not require Application update or sync permission
- Trigger point: Manifest generation through application processing, server-side diff, or the application manifest upload endpoint
- Why exploitation is possible: Jsonnet import, importstr, and importbin operations are not reliably confined to the repository root, allowing access to readable paths and potentially unbounded input streams
Why this happens
The underlying bug is an insufficiently constrained filesystem resolution policy in
the Jsonnet importer. Import operations accept absolute paths, parent-directory
traversal, and symlink-mediated paths that can refer outside the intended repository
boundary. This behavior maps to CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), because repository-controlled input can
influence access to files outside the authorized directory. Importing a
non-terminating device can additionally create an uncontrolled resource-consumption
condition.
The underlying bug is an insufficiently constrained filesystem resolution policy in
the Jsonnet importer. Import operations accept absolute paths, parent-directory
traversal, and symlink-mediated paths that can refer outside the intended repository
boundary. This behavior maps to CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), because repository-controlled input can
influence access to files outside the authorized directory. Importing a
non-terminating device can additionally create an uncontrolled resource-consumption
condition.
Potential impact
- Sensitive files such as service-account tokens, private keys, credentials, or process environment data may be disclosed
- Repository and cluster credentials could be exposed to an unauthorized caller
- Generated application manifests may contain attacker-selected confidential content
- The repo-server may experience memory exhaustion and become unavailable
- Downstream deployment, review, or GitOps workflows could be disrupted
- Sensitive files such as service-account tokens, private keys, credentials, or process environment data may be disclosed
- Repository and cluster credentials could be exposed to an unauthorized caller
- Generated application manifests may contain attacker-selected confidential content
- The repo-server may experience memory exhaustion and become unavailable
- Downstream deployment, review, or GitOps workflows could be disrupted
General mitigation guidance
Mitigation generally focuses on enforcing a strict repository filesystem boundary
during all Jsonnet import operations.
Common defensive patterns include:
- Resolve and canonicalize import paths before access, then reject paths outside the permitted repository root
- Block absolute paths, parent-directory traversal, and symlink escapes
- Apply equivalent restrictions to import, importstr, and importbin
- Restrict or disable user-provided manifest uploads where they are not required
- Run repo-server with least-privilege filesystem, token, and credential access
- Apply resource limits and bounded input handling to reduce memory-exhaustion risk
- Avoid exposing sensitive files or credentials to the repo-server runtime
- Enforce authorization policies that limit who can trigger manifest generation
Mitigation generally focuses on enforcing a strict repository filesystem boundary
during all Jsonnet import operations.
Common defensive patterns include:
- Resolve and canonicalize import paths before access, then reject paths outside the permitted repository root
- Block absolute paths, parent-directory traversal, and symlink escapes
- Apply equivalent restrictions to import, importstr, and importbin
- Restrict or disable user-provided manifest uploads where they are not required
- Run repo-server with least-privilege filesystem, token, and credential access
- Apply resource limits and bounded input handling to reduce memory-exhaustion risk
- Avoid exposing sensitive files or credentials to the repo-server runtime
- Enforce authorization policies that limit who can trigger manifest generation
How teams detect issues like this
Organizations can identify this class of issue through:
- Static analysis and code review checks for path joins, filesystem reads, or import resolvers that do not canonicalize and confine paths
- Tests covering absolute paths, parent-directory traversal, symlinks, and special files
- Policy checks for manifest-upload APIs and unusually broad Application permissions
- Runtime monitoring for repo-server reads outside expected repository directories
- Alerts on generated manifests containing token, key, credential, or environment-derived data
- Resource monitoring for anomalous repo-server memory growth during Jsonnet evaluation
Automated security review tools can help flag unbounded filesystem access and missing path-boundary checks.
Organizations can identify this class of issue through:
- Static analysis and code review checks for path joins, filesystem reads, or import resolvers that do not canonicalize and confine paths
- Tests covering absolute paths, parent-directory traversal, symlinks, and special files
- Policy checks for manifest-upload APIs and unusually broad Application permissions
- Runtime monitoring for repo-server reads outside expected repository directories
- Alerts on generated manifests containing token, key, credential, or environment-derived data
- Resource monitoring for anomalous repo-server memory growth during Jsonnet evaluation
Automated security review tools can help flag unbounded filesystem access and missing path-boundary checks.
