OpenParable
Skip to content
← Back to skills

Argocd Tactics

DevOps & Security
argocd-tactics

Argocd Tactics is an Agent Skill for devops & security published in the wgpsec/AboutSecurity repository on GitHub: a SKILL.md instruction file an AI agent can load to do this task.

ArgoCD 后渗透方法论：Redis缓存投毒集群接管、SSO认证绕过、未授权API枚举、恶意Application部署、Webhook SSRF、默认凭据利用。 当用户提到ArgoCD漏洞、ArgoCD利用、ArgoCD RCE、ArgoCD Redis、ArgoCD未授权、ArgoCD检测、GitOps安全时，必须使用此技能。 也适用于用户提到K8s持续交付、Kubernetes GitOps、ArgoCD集群接管、ArgoCD缓存投毒等场景。

View on GitHub ↗
QUICK START

How to use this skill

Bring this guide into your coding agent with a prompt tailored to the tool you use.

  1. Open your project in Codex.
  2. Copy and paste the prompt below.
  3. Review files and risks before approving any action.
Prompt to paste
Inspect the Agent Skill at https://github.com/wgpsec/AboutSecurity/blob/HEAD/skills/postexploit/product/argocd-tactics/SKILL.md and all supporting files. Report provenance, permissions, scripts, dependencies, and security risks. Propose an exact installation into .agents/skills/argocd-tactics, but wait for my approval before writing files or running scripts.

Copying this prompt does not install or run the skill. Review third-party files before use.

ArgoCD 漏洞利用技能

  • 产品: Argo CD (Kubernetes声明式GitOps持续交付工具)
  • 默认端口: 80/443 (Web UI), 8080 (Server), 6379 (Redis)
  • 识别特征: 页面标题 "Argo CD"，/api/v1/version 返回版本信息
  • 默认凭据: admin / auto-generated初始密码
  • FOFA: app="Argo-CD" | Shodan: http.title:"Argo CD"

漏洞总览

CVE影响版本类型条件危害
CVE-2024-31989<2.11.5Redis缓存投毒→K8s接管Redis未认证Critical (9.1)
CVE-2022-29165<2.3.1SSO认证绕过配置OIDC SSOHigh (8.8)
CVE-2023-22482多版本Redis信息泄露Redis未认证High (7.5)
CVE-2024-40638多版本Webhook SSRF已认证用户High (7.2)
默认凭据全版本初始admin密码获取初始密码Critical

利用决策树

1. 识别ArgoCD → /api/v1/version
2. 未授权API → /api/v1/applications, /api/v1/clusters
3. CVE-2024-31989 (优先) → Redis缓存投毒 → 集群接管
4. 默认凭据 → admin + 初始密码 → 完全控制
5. CVE-2022-29165 (SSO环境) → redirect_uri绕过
6. CVE-2024-40638 → Webhook SSRF
7. 已认证后利用 → 恶意Application / 注入Manifest / 越权

利用链优先级

1. Redis未授权 → CVE-2024-31989缓存投毒 → K8s集群接管
2. 默认凭据/弱口令 → ArgoCD完全控制
3. 未授权API → 应用/集群/仓库信息泄露
4. CVE-2022-29165 → SSO认证绕过
5. CVE-2024-40638 → Webhook SSRF → 内部服务探测
6. 已认证 → 创建恶意Application → 特权Pod部署

常用端点速查

端点方法用途认证
/api/v1/versionGET版本信息不需要
/api/v1/applicationsGET应用列表可选
/api/v1/clustersGET集群列表可选
/api/v1/repositoriesGET仓库列表可选
/api/v1/accountGET账户信息可选
/auth/loginGET登录页面不需要
Redis 6379-缓存服务默认无密码

详细参考