All versions of Argo CD starting with v1.8.2 are vulnerable to an improper authorization bug causing the API to accept certain invalid tokens. OIDC providers include an aud (audience) claim in signed tokens. The value of that claim specifies the intended audience(s) of the token (i.e. the service or services which are meant to accept the token). Argo CD *does* validate that the token was signed by Argo CD's configured OIDC provider. But Argo CD *does not* validate the audience claim, so it will accept tokens that are not intended for Argo CD. If Argo CD's configured OIDC provider also serves other audiences (for example, a file storage service), then Argo CD will accept a token intended for one of those other audiences. Argo CD will grant the user privileges based on the token's groups claim, even though those groups were not intended to be used by Argo CD. This bug also increases the blast radius of a stolen token. If an attacker steals a valid token for a different audience, they can use it to access Argo CD.
This issue has been addressed in the following products: Red Hat OpenShift GitOps 1.6 Via RHSA-2023:0466 https://access.redhat.com/errata/RHSA-2023:0466
This issue has been addressed in the following products: Red Hat OpenShift GitOps 1.7 Via RHSA-2023:0467 https://access.redhat.com/errata/RHSA-2023:0467
This issue has been addressed in the following products: Red Hat OpenShift GitOps 1.5 Via RHSA-2023:0468 https://access.redhat.com/errata/RHSA-2023:0468
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2023-22482
For exploit this issue the attacker needs to use a signed token by OIDC provider, meaning it should have at least some degree of privileges is required to accomplish a successful attack.