id: GO-2024-2652
modules:
    - module: github.com/argoproj/argo-cd/v2
      versions:
        - fixed: 2.8.13
        - introduced: 2.9.0
          fixed: 2.9.9
        - introduced: 2.10.0
          fixed: 2.10.4
      vulnerable_at: 2.10.3
      packages:
        - package: github.com/argoproj/argo-cd/v2/util/session
          symbols:
            - SessionManager.updateFailureCount
            - getMaximumCacheSize
          derived_symbols:
            - SessionManager.VerifyUsernamePassword
summary: Brute force protection bypass in github.com/argoproj/argo-cd/v2
description: |-
    An attacker can effectively bypass the rate limit and brute force protections in
    Argo CD by exploiting the application's weak cache-based mechanism. The
    application's brute force protection relies on a cache mechanism that tracks
    login attempts for each user. An attacker can overflow this cache by bombarding
    it with login attempts for different users, thereby pushing out the admin
    account's failed attempts and effectively resetting the rate limit for that
    account.
cves:
    - CVE-2024-21662
    - CVE-2024-21652
ghsas:
    - GHSA-2vgg-9h6w-m454
    - GHSA-x32m-mvfj-52xv
credits:
    - '@nadava669'
    - '@pasha-codefresh'
    - '@crenshaw-dev'
    - '@todaywasawesome'
    - '@jannfis'
references:
    - fix: https://github.com/argoproj/argo-cd/commit/17b0df1168a4c535f6f37e95f25ed7cd81e1fa4d
    - fix: https://github.com/argoproj/argo-cd/commit/6e181d72b31522f886a2afa029d5b26d7912ec7b
    - fix: https://github.com/argoproj/argo-cd/commit/cebb6538f7944c87ca2fecb5d17f8baacc431456
    - web: https://argo-cd.readthedocs.io/en/stable/security_considerations/#cve-2020-8827-insufficient-anti-automationanti-brute-force