Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact
NA

CVE-2023-5043

Published: 25/10/2023 Updated: 07/03/2024
CVSS v3 Base Score: 8.8 | Impact Score: 5.9 | Exploitability Score: 2.8
VMScore: 0
Subscribe to Ingress-nginx

Vulnerability Summary

Ingress nginx annotation injection causes arbitrary command execution.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

kubernetes ingress-nginx

Github Repositories

https://github.com/r0binak/CVE-2023-5043

PoC CVE-2023-5043

CVE-2023-5043 Ingress nginx annotation injection causes arbitrary command execution Create Ingress (can be created without Service and Pod) apiVersion: networkingk8sio/v1 kind: Ingress metadata: name: ingress-exploit annotations: kubernetesio/ingressclass: "nginx" nginxingresskubernetesio/configuration-snippet: | more_set_headers "robin

Recent Articles

Unpatched NGINX ingress controller bugs can be abused to steal Kubernetes cluster secrets
The Register

Topics Security Off-Prem On-Prem Software Offbeat Special Features Vendor Voice Vendor Voice Resources Just tricks, no treats with these 3 vulns

Three unpatched high-severity bugs in the NGINX ingress controller can be abused by miscreants to steal credentials and other secrets from Kubernetes clusters.  The vulnerabilities, tracked as CVE-2023-5043, CVE-2023-5044 and CVE-2022-4886, were disclosed on October 27, and are listed as currently awaiting triage. It's unclear if any of the flaws have been exploited. The Register did not immediately receive a response to questions, including if the bugs have been found and exploited and whe...

Read more...

References

CWE-74https://github.com/kubernetes/ingress-nginx/issues/10571https://groups.google.com/g/kubernetes-security-announce/c/pVsXsOpxYZohttp://www.openwall.com/lists/oss-security/2023/10/25/4https://security.netapp.com/advisory/ntap-20240307-0012/https://nvd.nist.govhttps://github.com/r0binak/CVE-2023-5043https://www.theregister.co.uk/2023/10/30/unpatched_nginx_ingress_controller_bugs/
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-21111CVE-2024-32884IDORCVE-2023-1000CVE-2024-33260CVE-2024-3682reflected XSSrace conditionCVE-2024-3400
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook