Vulmon
Critical Infrastructure Sectors: Critical Manufacturing
Arbitrary Code Execution in Kubernetes Ingress-Nginx via Annotation Configuration Injection
A security vulnerability exists in ingress-nginx, a Kubernetes component hosted on GitHub, involving the `mirror-target` and `mirror-host` Ingress annotations. These annotations can be exploited to inject malicious configuration directly into nginx. This injection can potentially enable arbitrary code execution within the ingress-nginx controller and allow unauthorized disclosure of Secrets that are accessible to the controller. In the default installation configuration, the controller has access to Secrets across the entire cluster, which significantly increases the potential impact of this security issue.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
kubernetes ingress-nginx |
Topics Security Off-Prem On-Prem Software Offbeat Special Features Vendor Voice Vendor Voice Resources How many K8s systems are sat on the internet front porch like that ... Oh, thousands, apparently
Cloudy infosec outfit Wiz has discovered serious vulnerabilities in the admission controller component of Ingress-Nginx Controller that could allow the total takeover of Kubernetes clusters – and thinks more than 6,000 deployments of the software are at risk on the internet. Kubernetes (K8s) clusters are exposed more often than you might think to external HTTP/S traffic, to allow outside access to the applications they run. Putting the cluster admission controller out there, too, doesn't seem ...