Vulmon
Critical Infrastructure Sectors: Critical Manufacturing
Arbitrary Code Execution in Kubernetes Ingress-Nginx via Malicious Auth-URL Annotation
A security vulnerability exists in ingress-nginx where the `auth-url` Ingress annotation can be exploited to inject configuration into nginx. This vulnerability allows an attacker to execute arbitrary code within the ingress-nginx controller context and potentially disclose Secrets that are accessible to the controller. In the default installation, the controller has access to Secrets across the entire cluster, which increases the potential impact of this security issue.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
kubernetes ingress-nginx |
Topics Security Off-Prem On-Prem Software Offbeat Special Features Vendor Voice Vendor Voice Resources How many K8s systems are sat on the internet front porch like that ... Oh, thousands, apparently
Cloudy infosec outfit Wiz has discovered serious vulnerabilities in the admission controller component of Ingress-Nginx Controller that could allow the total takeover of Kubernetes clusters – and thinks more than 6,000 deployments of the software are at risk on the internet. Kubernetes (K8s) clusters are exposed more often than you might think to external HTTP/S traffic, to allow outside access to the applications they run. Putting the cluster admission controller out there, too, doesn't seem ...