A Kubernetes ingress controller project called ingress-nginx has revealed four vulnerabilities that allow the execution of arbitrary code on cloud system servers using the Kubernetes platform, resulting in full privileged access to the Kubernetes cluster. The vulnerabilities have been assigned a critical severity level (9.8 out of 10). Researchers identifying these issues have code-named the vulnerabilities IngressNightmare, noting that they affect approximately 43% of cloud environments. The vulnerabilities have been fixed in ingress-nginx versions 1.11.5 and 1.12.1. <\/p>\n
The ingress controller acts as a gateway and is used in Kubernetes to facilitate access from an external network to services within the cluster. The ingress-nginx controller is the most popular and utilizes szerver<\/a> NGINX is used for proxying requests to the cluster, routing external requests, and load balancing. The Kubernetes project provides basic ingress controllers for AWS, GCE, and nginx, the latter of which is not related to the kubernetes-ingress controller maintained by F5\/NGINX (the vulnerabilities discussed do not affect projects developed by NGINX developers; the mention of nginx in the name ingress-nginx is solely related to using nginx as a proxy). <\/p>\n The vulnerabilities allow an unauthenticated attacker to execute arbitrary code in the context of the ingress-nginx controller when it is possible to send a request to the Admission web handler. During network scanning, over 6,500 vulnerable Kubernetes clusters were identified using publicly accessible vulnerable controllers with an Admission handler open to external requests. <\/p>\n Alap\u00e9rtelmezett konfigur\u00e1ci\u00f3 eset\u00e9n a t\u00e1mad\u00f3 \u00e1ltal futtatott k\u00f3d hozz\u00e1f\u00e9r\u00e9st nyerhet az Ingress objektum be\u00e1ll\u00edt\u00e1saihoz, ahol t\u00f6bbek k\u00f6z\u00f6tt a Kubernetes szerverekhez val\u00f3 kapcsol\u00f3d\u00e1shoz sz\u00fcks\u00e9ges hiteles\u00edt\u0151 adatokat t\u00e1rolj\u00e1k. A jogosults\u00e1gokkal val\u00f3 vissza\u00e9l\u00e9s elker\u00fcl\u00e9se \u00e9rdek\u00e9ben aj\u00e1nlott az ingress-nginx-ben letiltani a \u201eValidating Admission Controller\u201d funkci\u00f3t. <\/p>\n The Admission controller runs in a separate pod environment and performs the verification of incoming ingress objects before their deployment. By default, the Admission web handler accepts unauthenticated requests from the public network. During the verification process, the Admission controller creates a configuration for the nginx http server based on the contents of the received ingress object and checks its correctness. <\/p>\n Az \u00e9szlelt sebezhet\u0151s\u00e9gek lehet\u0151v\u00e9 teszik a nginx-be t\u00f6rt\u00e9n\u0151 be\u00e1ll\u00edt\u00e1sok becser\u00e9l\u00e9s\u00e9t egy speci\u00e1lisan elk\u00e9sz\u00edtett ingress-objektum k\u00f6zvetlen elk\u00fcld\u00e9s\u00e9vel az Admission vez\u00e9rl\u0151nek. A kutat\u00f3k felfedezt\u00e9k, hogy bizonyos ellen\u0151rz\u0151 k\u00e9r\u00e9sek tulajdons\u00e1gai, amelyek a \u201e.request.object.annotations\u201d mez\u0151ben tal\u00e1lhat\u00f3k, k\u00f6zvetlen\u00fcl beilleszt\u0151dnek a nginx konfigur\u00e1ci\u00f3j\u00e1ba. Az el\u0151\u00e1ll\u00edtott konfigur\u00e1ci\u00f3t nem alkalmazz\u00e1k, csup\u00e1n tesztelik a \u201enginx\u201d v\u00e9grehajthat\u00f3 f\u00e1jl \u201e-t\u201d opci\u00f3val t\u00f6rt\u00e9n\u0151 futtat\u00e1s\u00e1val. <\/p>\n K\u00fcl\u00f6n\u00f6sen a k\u00fcls\u0151 adatok konfigur\u00e1ci\u00f3ba val\u00f3 becser\u00e9l\u00e9se az al\u00e1bbi param\u00e9terekre vonatkozik: \u201emirror-target\u201d, \u201emirror-host\u201d (CVE-2025-1098), \u201eauth-tls-match-cn\u201d (CVE-2025-1097) \u00e9s \u201eauth-url\u201d (CVE-2025-24514). P\u00e9ld\u00e1ul a \u201eset $target {{ $externalAuth.URL }};\u201d konfigur\u00e1ci\u00f3s sorban a \u201e{{ $externalAuth.URL }}\u201d helyett az \u201eauth-url\u201d param\u00e9terben megadott URL ker\u00fcl behelyettes\u00edt\u00e9sre. Ekkor az URL \u00e9rv\u00e9nyess\u00e9ge nem ellen\u0151rizhet\u0151. Ennek megfelel\u0151en a t\u00e1mad\u00f3 megadhat egy URL-t, mint p\u00e9ld\u00e1ul \u201ehttp:\/\/example.com\/#;\nbe\u00e1ll\u00edt\u00e1sok\u201d, \u00e9s belehelyettes\u00edtheti saj\u00e1t be\u00e1ll\u00edt\u00e1sait a konfigur\u00e1ci\u00f3s f\u00e1jlba. <\/p>\n Tetsz\u0151leges k\u00f3d v\u00e9grehajt\u00e1s\u00e1hoz a konfigur\u00e1ci\u00f3 ellen\u0151rz\u00e9se sor\u00e1n az \u201enginx -t\u201d parancs seg\u00edts\u00e9g\u00e9vel a kutat\u00f3k kihaszn\u00e1lt\u00e1k azt, hogy a nginx a szintaxis ellen\u0151rz\u00e9se mellett bet\u00f6lti a modulokhoz tartoz\u00f3 k\u00f6nyvt\u00e1rakat \u00e9s megnyitja a konfigur\u00e1ci\u00f3ban eml\u00edtett f\u00e1jlokat az el\u00e9rhet\u0151s\u00e9g\u00fck \u00e9rt\u00e9kel\u00e9s\u00e9re. T\u00f6bbek k\u00f6z\u00f6tt az ssl_engine utas\u00edt\u00e1s feldolgoz\u00e1sa sor\u00e1n bet\u00f6lt\u00e9sre ker\u00fcl a megadott megosztott k\u00f6nyvt\u00e1r. SSL<\/a>-motor. <\/p>\n A kutat\u00f3k a Kubernetes szerverre val\u00f3 k\u00f6nyvt\u00e1ruk felt\u00f6lt\u00e9s\u00e9re (CVE-2025-1974) azt haszn\u00e1lt\u00e1k ki, hogy a nginx a nagy k\u00e9r\u00e9sek feldolgoz\u00e1sa sor\u00e1n a k\u00e9relem test\u00e9t egy ideiglenes f\u00e1jlba menti, amelyet azonnal t\u00f6r\u00f6l, de a f\u00e1jlrendszerben a « \/proc » › sz\u00e1m\u00e1ra megmarad egy nyitott f\u00e1jl le\u00edr\u00f3. \u00cdgy egyszerre lehet k\u00e9r\u00e9seket k\u00fcldeni az ideiglenes f\u00e1jl t\u00e1rol\u00e1s\u00e1ra \u00e9s a konfigur\u00e1ci\u00f3 ellen\u0151rz\u00e9s\u00e9nek kezdem\u00e9nyez\u00e9s\u00e9re, amelyben az « ssl_engine » direkt\u00edva megadja a f\u00e1jl le\u00edr\u00f3 \u00fatvonal\u00e1t a « \/proc » f\u00e1jlrendszerben. <\/p>\n Annak \u00e9rdek\u00e9ben, hogy a f\u00e1jl le\u00edr\u00f3 hossz\u00fa ideig el\u00e9rhet\u0151 maradjon, a k\u00e9r\u00e9sben a « Content-Length » \u00e9rt\u00e9ket c\u00e9lszer\u0171en nagyobbra lehet \u00e1ll\u00edtani, mint a t\u00e9nylegesen \u00e1tadott adatok (a szerver v\u00e1rni fog a tov\u00e1bbi adatok \u00e1tv\u00e9tel\u00e9re). Tov\u00e1bbi neh\u00e9zs\u00e9get jelent, hogy ki kell tal\u00e1lni a folyamat PID-j\u00e9t \u00e9s a felt\u00f6lt\u00f6tt megosztott k\u00f6nyvt\u00e1rral kapcsolatos f\u00e1jl le\u00edr\u00f3 sz\u00e1mot, de mivel a kont\u00e9nerben \u00e1ltal\u00e1ban minim\u00e1lis sz\u00e1m\u00fa fut\u00f3 folyamat van, a sz\u00fcks\u00e9ges \u00e9rt\u00e9kek kital\u00e1l\u00e1sa t\u00f6bb k\u00eds\u00e9rletem kereszt\u00fcl t\u00f6rt\u00e9nik. Siker eset\u00e9n, ha a megadott megosztott k\u00f6nyvt\u00e1rat bet\u00f6ltik, a t\u00e1mad\u00f3 hozz\u00e1f\u00e9r\u00e9st nyerhet a pod k\u00f6rnyezet\u00e9ben t\u00e1rolt param\u00e9terekhez, amelyek elegend\u0151ek lehetnek az eg\u00e9sz klaszter ir\u00e1ny\u00edt\u00e1s\u00e1ra.