CVE-2024-22424

CVE-2024-22424 is a high-severity cross-site request forgery (CSRF) vulnerability affecting Argo CD API versions prior to 2.10-rc2, 2.9.4, 2.8.8, and 2.7.15. An attacker with the ability to write HTML on a page within the same parent domain as Argo CD could trick an authenticated user into executing malicious API calls, potentially leading to arbitrary code execution. The vulnerability arises because Argo CD previously failed to validate content type headers, allowing attackers to bypass browser CORS protections by using non-sensitive content types. This vulnerability has a CVSS score of 8.3 (HIGH) due to its network attack vector, high impact on confidentiality, integrity, and availability, and the requirement for user interaction. There is no evidence of active exploitation, public exploit code, or significant community discussion, and the vulnerability is not listed in the KEV catalog.