Summary
Argo CD's repo-server can execute attacker-controlled commands when it handles an SSH Git repository configured with a crafted proxy URL. An attacker who can create or modify a repository or repository credential template may compromise the repo-server and access credentials used for Git, Helm, and OCI operations.
Argo CD's repo-server can execute attacker-controlled commands when it handles an SSH Git repository configured with a crafted proxy URL. An attacker who can create or modify a repository or repository credential template may compromise the repo-server and access credentials used for Git, Helm, and OCI operations.
Affected context
The vulnerability occurs in Argo CD deployments where the repo-server clones, tests, or fetches SSH-based Git repositories through a configured proxy URL. It becomes risky when a user has permission to create or update repository definitions or credential templates and proxy host or port values are incorporated into an SSH ProxyCommand executed by a shell.
The vulnerability occurs in Argo CD deployments where the repo-server clones, tests, or fetches SSH-based Git repositories through a configured proxy URL. It becomes risky when a user has permission to create or update repository definitions or credential templates and proxy host or port values are incorporated into an SSH ProxyCommand executed by a shell.
Exploit preconditions
- Attack surface: Argo CD repo-server repository and credential-template configuration
- Required access: Permission to create or modify a repository or repository credential template
- Trigger point: The repo-server performs an SSH Git clone, test, or fetch using the configured proxy
- Why exploitation is possible: Proxy values are embedded in a shell-executed SSH ProxyCommand without adequately neutralizing shell metacharacters
- Attack surface: Argo CD repo-server repository and credential-template configuration
- Required access: Permission to create or modify a repository or repository credential template
- Trigger point: The repo-server performs an SSH Git clone, test, or fetch using the configured proxy
- Why exploitation is possible: Proxy values are embedded in a shell-executed SSH ProxyCommand without adequately neutralizing shell metacharacters
Why this happens
The underlying bug is command construction from insufficiently trusted configuration data. Proxy host and port values are incorporated into a shell command rather than being safely passed as structured arguments or rigorously constrained values.
Shell metacharacters in attacker-controlled input can alter command interpretation and cause unintended operating-system command execution. This behavior maps to CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection').
The underlying bug is command construction from insufficiently trusted configuration data. Proxy host and port values are incorporated into a shell command rather than being safely passed as structured arguments or rigorously constrained values.
Shell metacharacters in attacker-controlled input can alter command interpretation and cause unintended operating-system command execution. This behavior maps to CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection').
Potential impact
- An attacker may execute arbitrary commands in the repo-server process context.
- The attacker could access Git, Helm, and OCI credentials available to the repo-server.
- Repository content, deployment workflows, or stored configuration may be modified.
- The compromise could enable lateral movement toward connected Kubernetes or source-control systems.
- Sensitive repository and deployment data could be disclosed or tampered with.
- An attacker may execute arbitrary commands in the repo-server process context.
- The attacker could access Git, Helm, and OCI credentials available to the repo-server.
- Repository content, deployment workflows, or stored configuration may be modified.
- The compromise could enable lateral movement toward connected Kubernetes or source-control systems.
- Sensitive repository and deployment data could be disclosed or tampered with.
General mitigation guidance
Mitigation generally focuses on removing shell interpretation from command execution and reducing trust in repository configuration values.
Common defensive patterns include:
- Invoke SSH and proxy mechanisms through structured argument APIs instead of shell-generated command strings.
- Apply strict allowlists and validation to proxy hosts, ports, schemes, and related repository settings.
- Neutralize or reject shell metacharacters rather than attempting ad hoc escaping.
- Limit which users and automation identities can create or modify repositories and credential templates.
- Run repo-server with least privilege and restrict access to credentials, filesystems, and network destinations.
- Separate and scope Git, Helm, and OCI credentials according to repository and environment needs.
Mitigation generally focuses on removing shell interpretation from command execution and reducing trust in repository configuration values.
Common defensive patterns include:
- Invoke SSH and proxy mechanisms through structured argument APIs instead of shell-generated command strings.
- Apply strict allowlists and validation to proxy hosts, ports, schemes, and related repository settings.
- Neutralize or reject shell metacharacters rather than attempting ad hoc escaping.
- Limit which users and automation identities can create or modify repositories and credential templates.
- Run repo-server with least privilege and restrict access to credentials, filesystems, and network destinations.
- Separate and scope Git, Helm, and OCI credentials according to repository and environment needs.
How teams detect issues like this
Detection can include:
- Static analysis for shell invocation APIs, command concatenation, and interpolation of repository or proxy fields.
- Code review checks for ProxyCommand construction and untrusted configuration values reaching process execution.
- Runtime monitoring for unexpected child processes, shell launches, outbound connections, or access to credential files from repo-server.
- Policy enforcement requiring validated proxy formats and restricting repository-management permissions.
- Audit review of repository and credential-template changes, especially those introducing proxy configuration.
Automated code review and application security tools may help identify command construction patterns, but findings should be verified against the actual execution path.
Detection can include:
- Static analysis for shell invocation APIs, command concatenation, and interpolation of repository or proxy fields.
- Code review checks for ProxyCommand construction and untrusted configuration values reaching process execution.
- Runtime monitoring for unexpected child processes, shell launches, outbound connections, or access to credential files from repo-server.
- Policy enforcement requiring validated proxy formats and restricting repository-management permissions.
- Audit review of repository and credential-template changes, especially those introducing proxy configuration.
Automated code review and application security tools may help identify command construction patterns, but findings should be verified against the actual execution path.
