A Kubernetes ingress controller project called ingress-nginx has revealed three vulnerabilities that allow access to the Ingress object settings in the default configuration, which include credentials for accessing Kubernetes servers, enabling privileged access to the cluster. These issues occur only in the ingress-nginx controller from the Kubernetes project and do not affect the kubernetes-ingress controller developed by NGINX developers.
The ingress controller acts as a gateway and is used in Kubernetes to facilitate access from an external network to services within the cluster. The ingress-nginx controller is the most popular and utilizes szerver NGINX to organize request forwarding to the cluster, route external requests, and balance load. The Kubernetes project provides basic ingress controllers for AWS, GCE, and nginx, the latter of which is not related to the kubernetes-ingress controller, which is maintained by F5/NGINX.
The vulnerabilities CVE-2023-5043 and CVE-2023-5044 allow the execution of custom code with szerveren the permissions of the ingress controller process by using the parameters 'nginx.ingress.kubernetes.io/configuration-snippet' and 'nginx.ingress.kubernetes.io/permanent-redirect' for substitution. Among other things, the obtained access rights allow for the extraction of a token used for authentication at the cluster management level. The vulnerability CVE-2022-4886 allows bypassing file path checks using the log_format directive.
The first two vulnerabilities occur only in ingress-nginx releases prior to version 1.9.0, while the last one affects versions before 1.8.0. To execute an attack, an attacker must have access to the ingress object configuration, for example, in multi-user Kubernetes clusters where users are given the ability to create objects in their own namespace.
Forrás: opennet.ru
