Argo Workflows (Argo Server, artifact directory listing renderer): Object names are printed into the artifact directory

Impact

Object names are printed into the artifact directory listing HTML without escaping, and those names come from whatever files a workflow wrote. Any tenant who can run a workflow plants stored JavaScript that executes under the Argo Server origin in another user's browser, then drives the Argo API with that victim's privileges - submitting workflows, reading templates, deleting other tenants' runs.

Who can reach it

A tenant with workflow-submit rights plants the payload; an admin or another tenant triggers it by browsing the artifact listing in the Argo UI.

What to do

Upgrade to 3.6.17 or 3.7.8 and restart Argo Server. Until then, tell operators not to browse artifact directory listings for workflows submitted by untrusted tenants, and consider a CSP at the ingress in front of the UI.

References