data/reports: add GO-2024-2652.yaml

Aliases: CVE-2024-21662, GHSA-2vgg-9h6w-m454, CVE-2024-21652, GHSA-x32m-mvfj-52xv Fixes #2652 Fixes #2651 Change-Id: I833a78df2210cd6fcf5948fdfc77160392f293ea Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/573556 Reviewed-by: Damien Neil <dneil@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> Run-TryBot: Tim King <taking@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
golang · Mar 22, 2024 · ccfc322 · ccfc322
1 parent e8795f2
commit ccfc322
Show file tree

Hide file tree

Showing 2 changed files with 140 additions and 0 deletions.
diff --git a/data/osv/GO-2024-2652.json b/data/osv/GO-2024-2652.json
@@ -0,0 +1,97 @@
+{
+  "schema_version": "1.3.1",
+  "id": "GO-2024-2652",
+  "modified": "0001-01-01T00:00:00Z",
+  "published": "0001-01-01T00:00:00Z",
+  "aliases": [
+    "CVE-2024-21662",
+    "CVE-2024-21652",
+    "GHSA-2vgg-9h6w-m454",
+    "GHSA-x32m-mvfj-52xv"
+  ],
+  "summary": "Brute force protection bypass in github.com/argoproj/argo-cd/v2",
+  "details": "An attacker can effectively bypass the rate limit and brute force protections in Argo CD by exploiting the application's weak cache-based mechanism. The application's brute force protection relies on a cache mechanism that tracks login attempts for each user. An attacker can overflow this cache by bombarding it with login attempts for different users, thereby pushing out the admin account's failed attempts and effectively resetting the rate limit for that account.",
+  "affected": [
+    {
+      "package": {
+        "name": "github.com/argoproj/argo-cd/v2",
+        "ecosystem": "Go"
+      },
+      "ranges": [
+        {
+          "type": "SEMVER",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "2.8.13"
+            },
+            {
+              "introduced": "2.9.0"
+            },
+            {
+              "fixed": "2.9.9"
+            },
+            {
+              "introduced": "2.10.0"
+            },
+            {
+              "fixed": "2.10.4"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "imports": [
+          {
+            "path": "github.com/argoproj/argo-cd/v2/util/session",
+            "symbols": [
+              "SessionManager.VerifyUsernamePassword",
+              "SessionManager.updateFailureCount",
+              "getMaximumCacheSize"
+            ]
+          }
+        ]
+      }
+    }
+  ],
+  "references": [
+    {
+      "type": "FIX",
+      "url": "https://github.com/argoproj/argo-cd/commit/17b0df1168a4c535f6f37e95f25ed7cd81e1fa4d"
+    },
+    {
+      "type": "FIX",
+      "url": "https://github.com/argoproj/argo-cd/commit/6e181d72b31522f886a2afa029d5b26d7912ec7b"
+    },
+    {
+      "type": "FIX",
+      "url": "https://github.com/argoproj/argo-cd/commit/cebb6538f7944c87ca2fecb5d17f8baacc431456"
+    },
+    {
+      "type": "WEB",
+      "url": "https://argo-cd.readthedocs.io/en/stable/security_considerations/#cve-2020-8827-insufficient-anti-automationanti-brute-force"
+    }
+  ],
+  "credits": [
+    {
+      "name": "@nadava669"
+    },
+    {
+      "name": "@pasha-codefresh"
+    },
+    {
+      "name": "@crenshaw-dev"
+    },
+    {
+      "name": "@todaywasawesome"
+    },
+    {
+      "name": "@jannfis"
+    }
+  ],
+  "database_specific": {
+    "url": "https://pkg.go.dev/vuln/GO-2024-2652"
+  }
+}
diff --git a/data/reports/GO-2024-2652.yaml b/data/reports/GO-2024-2652.yaml
@@ -0,0 +1,43 @@
+id: GO-2024-2652
+modules:
+    - module: github.com/argoproj/argo-cd/v2
+      versions:
+        - fixed: 2.8.13
+        - introduced: 2.9.0
+          fixed: 2.9.9
+        - introduced: 2.10.0
+          fixed: 2.10.4
+      vulnerable_at: 2.10.3
+      packages:
+        - package: github.com/argoproj/argo-cd/v2/util/session
+          symbols:
+            - SessionManager.updateFailureCount
+            - getMaximumCacheSize
+          derived_symbols:
+            - SessionManager.VerifyUsernamePassword
+summary: Brute force protection bypass in github.com/argoproj/argo-cd/v2
+description: |-
+    An attacker can effectively bypass the rate limit and brute force protections in
+    Argo CD by exploiting the application's weak cache-based mechanism. The
+    application's brute force protection relies on a cache mechanism that tracks
+    login attempts for each user. An attacker can overflow this cache by bombarding
+    it with login attempts for different users, thereby pushing out the admin
+    account's failed attempts and effectively resetting the rate limit for that
+    account.
+cves:
+    - CVE-2024-21662
+    - CVE-2024-21652
+ghsas:
+    - GHSA-2vgg-9h6w-m454
+    - GHSA-x32m-mvfj-52xv
+credits:
+    - '@nadava669'
+    - '@pasha-codefresh'
+    - '@crenshaw-dev'
+    - '@todaywasawesome'
+    - '@jannfis'
+references:
+    - fix: https://github.com/argoproj/argo-cd/commit/17b0df1168a4c535f6f37e95f25ed7cd81e1fa4d
+    - fix: https://github.com/argoproj/argo-cd/commit/6e181d72b31522f886a2afa029d5b26d7912ec7b
+    - fix: https://github.com/argoproj/argo-cd/commit/cebb6538f7944c87ca2fecb5d17f8baacc431456
+    - web: https://argo-cd.readthedocs.io/en/stable/security_considerations/#cve-2020-8827-insufficient-anti-automationanti-brute-force