.. / CVE-2024-37152

• Access Control
• Nuclei
• Web

Exploit for Argo CD Unauthenticated Access to sensitive setting (CVE-2024-37152)

Description:

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The vulnerability allows unauthorized access to the sensitive settings exposed by /api/v1/settings endpoint without authentication. All sensitive settings are hidden except passwordPattern.

Nuclei Template

View the template here CVE-2024-37152.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2024/CVE-2024-37152.yaml

References: