Caught in the Octopus Trap Unauthenticated RCE in Argo CD wi...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://synacktiv.com/en/publications/caught-in-the-octopus-trap-unauthenticated-rce-in-argo-cd-with-codeql.html
• Blog Title: Caught in the Octopus Trap: Unauthenticated RCE in Argo CD with CodeQL
• Suggested Section: Pentesting CI/CD -> Argo CD Security or Kubernetes Pentesting -> Argo CD / GitOps Attacks

🎯 Content Summary

Overview

Synacktiv documents an unauthenticated arbitrary code execution vulnerability in Argo CD's repo-server component. The issue is reachable when an attacker has network access to the repo-server gRPC service, typically on TCP 8081, and can call /repository.RepoServerService/GenerateManifest directly. By crafting a ManifestRequest, the attacker can force repo-server to clone an attacker-controlled Git repository, pass attacker-c...

🔧 Technical Details

Framework-specific CodeQL source modeling: In Go gRPC/REST applications, the most useful taint source may be the already-unmarshaled request object rather than the raw HTTP body. The article models methods with receiver Server or Service, first parameter context.Context, and second parameter as an attacker-controlled request. Marking Parameter[1] as a CodeQL RemoteFlowSource helps discover flows from typed API objects into dangerous sinks.

Custom Go command-injection sink modeling: If default CodeQL queries miss flows into os/exec, add sink models for exec.Command and exec.CommandContext. Marking the executable path and relevant argument positions as command-injection sinks allows taint tracking from API request fields to command execution calls such as exec.Command(k.getBinaryPath(), params...).

🤖 Agent Actions

Progress update only:

• I reviewed the updated references for consistency.
• Applied a minimal cleanup in the same file:
  • clearer labels for the newly added references
• Re-checked the result:
  • still only one modified file
  • no new scope added
  • diff remains clean and focused

Current modified file:

• src/pentesting-ci-cd/pentesting-ci-cd-methodology.md

Still holding the final wrap-up.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

📚 Repository Maintenance

• MD files processed: 588
• MD files fixed: 1

All .md files have been checked for proper formatting (headers, includes, etc.).

[carlospolop]

🔗 Additional Context

Original Blog Post: https://synacktiv.com/en/publications/caught-in-the-octopus-trap-unauthenticated-rce-in-argo-cd-with-codeql.html

Content Categories: Based on the analysis, this content was categorized under "Pentesting CI/CD -> Argo CD Security or Kubernetes Pentesting -> Argo CD / GitOps Attacks".

Repository Maintenance:

• MD Files Formatting: 588 files processed (1 files fixed)

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0