CVE-2022-31035:
Argo CD's external URLs for Deployments can include JavaScript
9.1
CVSS ScoreBasic Information
CVE ID
GHSA ID
EPSS Score
-
CWE
Published
6/21/2022
Updated
8/7/2024
KEV Status
No
Technology
Go
GoTechnical Details
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/argoproj/argo-cd | go | >= 1.0.0, <= 1.8.7 | 2.1.16 |
| github.com/argoproj/argo-cd/v2 | go | < 2.1.16 | 2.1.16 |
| github.com/argoproj/argo-cd/v2 | go | >= 2.2.0, < 2.2.10 | 2.2.10 |
| github.com/argoproj/argo-cd/v2 | go | >= 2.3.0, < 2.3.5 | 2.3.5 |
| github.com/argoproj/argo-cd/v2 | go | = 2.4.0 | 2.4.1 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability stems from improper URL validation when creating external links. The pre-patch version of the ExternalLink class in application-urls.tsx did not validate URL protocols, allowing malicious 'javascript:' links. The commit introduced protocol validation (isValidURL) and error handling, confirming that the absence of these checks in the constructor was the vulnerability source. The added test cases explicitly verify rejection of 'javascript:' URLs, demonstrating the previous lack of validation.