Miggo Logo
Miggo Vulnerability Database
→
CVE-2023-40025

CVE-2023-40025: Argo CD web terminal session doesn't expire

7.1

CVSS Score
3.1

Basic Information

CVE ID
CVE-2023-40025
GHSA ID
GHSA-c8xw-vjgf-94hr
EPSS Score
0.37%
CWE
CWE-613
Published
8/23/2023
Updated
11/7/2023
KEV Status
No
Technology
TechnologyGo

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
github.com/argoproj/argo-cdgo>= 2.6.0, < 2.6.142.6.14
github.com/argoproj/argo-cdgo>= 2.7.0, < 2.7.122.7.12
github.com/argoproj/argo-cdgo= 2.8.02.8.1

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from missing token validation in websocket message handling. The patch added: 1) SessionManager integration in terminalSession struct 2) Token verification in Read() method 3) Reconnect logic when tokens expire. The original Read() method (vulnerable) lacked the critical 'VerifyToken' check shown in the diff, allowing sessions to persist after token expiration. The newTerminalSession function's pre-patch version didn't pass sessionManager, preventing token validation infrastructure from being available during session initialization.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t *ll v*rsions o* *r*o ** st*rtin* *rom v*.*.* **v* * *u* w**r* op*n w** t*rmin*l s*ssions *o not *xpir*. T*is *u* *llows us*rs to s*n* *ny w**so*k*t m*ss***s *v*n i* t** tok*n **s *lr***y *xpir**. T** most str*i**t*orw*r* s**n*rio is w**n *

Reasoning

T** vuln*r**ility st*ms *rom missin* tok*n v*li**tion in w**so*k*t m*ss*** **n*lin*. T** p*t** *****: *) S*ssionM*n***r int**r*tion in t*rmin*lS*ssion stru*t *) Tok*n v*ri*i**tion in R***() m*t*o* *) R**onn**t lo*i* w**n tok*ns *xpir*. T** ori*in*l R