N\u00eb projektin n\u00eb zhvillim t\u00eb kontrollet t\u00eb ingress Kubernetes, ingress-nginx, jan\u00eb identifikuar kat\u00ebr vulnerabilitete q\u00eb lejojn\u00eb ekzekutimin e kodit t\u00eb p\u00ebrdoruesit n\u00eb server\u00ebt e sistemeve cloud q\u00eb p\u00ebrdorin platform\u00ebn Kubernetes, duke fituar k\u00ebshtu akses t\u00eb plot\u00eb dhe me privilegje n\u00eb klasterin Kubernetes. Problemet jan\u00eb vler\u00ebsuar me nj\u00eb nivel kritic rreziku (9.8 nga 10). K\u00ebrkuesit q\u00eb identifikuan problemet i dhan\u00eb k\u00ebtyre vulnerabiliteteve emrin kodor IngressNightmare dhe theksuan se ato prekin rreth 43% t\u00eb mjediseve cloud. Vulnerabilitetet jan\u00eb rregulluar n\u00eb versionet ingress-nginx 1.11.5 dhe 1.12.1. <\/p>\n
Ingress-controller vepron si nj\u00eb gateway dhe p\u00ebrdoret n\u00eb Kubernetes p\u00ebr t\u00eb organizuar qasjen nga rrjeti i jasht\u00ebm te sh\u00ebrbimet brenda klasterit. Controller-i ingress-nginx \u00ebsht\u00eb m\u00eb i p\u00ebrdoruri dhe p\u00ebrdor server<\/a> NGINX p\u00ebr t\u00eb dirigjuar k\u00ebrkesat n\u00eb klaster dhe p\u00ebr t\u00eb balancuar ngarkes\u00ebn. Projekti Kubernetes ofron kontrolle bazike ingress p\u00ebr AWS, GCE dhe nginx, i fundit prej t\u00eb cil\u00ebve nuk \u00ebsht\u00eb i lidhur me kontrollin kubernetes-ingress, p\u00ebr t\u00eb cilin p\u00ebrkujdeset kompanis\u00eb F5\/NGINX (vulnerabilitetet e shqyrtuara nuk prekin projektet q\u00eb zhvillohen nga zhvilluesit NGINX, p\u00ebrmendja e nginx n\u00eb emrin e ingress-nginx \u00ebsht\u00eb vet\u00ebm p\u00ebr shkak t\u00eb p\u00ebrdorimit t\u00eb nginx si nj\u00eb proksi). <\/p>\n Vulnerabilitetet lejojn\u00eb nj\u00eb sulmues t\u00eb paautorizuar t\u00eb ekzekutoj\u00eb kodin e tij n\u00eb kontekstin e kontrollit ingress-nginx, n\u00eb rastin e d\u00ebrgimit t\u00eb nj\u00eb k\u00ebrkese n\u00eb procesorin web Admission. Gjat\u00eb skanimit t\u00eb rrjetit jan\u00eb identifikuar m\u00eb shum\u00eb se 6500 klastere Kubernetes q\u00eb jan\u00eb vulnerab\u00ebl, duke p\u00ebrdorur kontrollet e ndjeshme me procesor t\u00eb hapur p\u00ebr k\u00ebrkesa t\u00eb jashtme. <\/p>\n N\u00eb konfigurimin e paracaktuar, kodi i ekzekutuar nga sulmuesi mund t\u00eb aksesoj\u00eb cil\u00ebsimet e objektit Ingress, ku nd\u00ebr t\u00eb tjera ruhen edhe kredencialet p\u00ebr t\u00eb komunikuar me serverat Kubernetes, duke lejuar p\u00ebrfitimin e aksesit me privilegje n\u00eb t\u00eb gjith\u00eb klasterin. Si nj\u00eb m\u00ebnyr\u00eb p\u00ebr t\u00eb anashkaluar mbrojtjen, rekomandohet t\u00eb \u00e7aktivizohet funksioni \u2018Validating Admission Controller\u2019 n\u00eb ingress-nginx. <\/p>\n Kontrolli Admission ekzekutohet n\u00eb nj\u00eb ambient t\u00eb ve\u00e7ant\u00eb pod dhe kryen operacionin e verifikimit t\u00eb objekteve ingress para shp\u00ebrndarjes s\u00eb tyre. N\u00eb konfigurimin e zakonsh\u00ebm, procesori web Admission pranon k\u00ebrkesa pa autentikim nga rrjeti publik. Gjat\u00eb verifikimit, kontrolli Admission krijon nj\u00eb konfigurim p\u00ebr serverin http t\u00eb nginx bazuar n\u00eb p\u00ebrmbajtjen e objektit ingress t\u00eb marr\u00eb dhe kontrollon sakt\u00ebsin\u00eb e saj. <\/p>\n D\u00ebshtimet e identifikuara lejojn\u00eb t\u00eb b\u00ebhet z\u00ebvend\u00ebsimi i cil\u00ebsimeve t\u00eb veta n\u00eb nginx p\u00ebrmes d\u00ebrgimit t\u00eb nj\u00eb objekti ingress t\u00eb formuluar posa\u00e7\u00ebrisht drejtp\u00ebrdrejt n\u00eb kontrolluesin e Admission. K\u00ebrkuesit zbuluan se disa pron\u00ebsi t\u00eb k\u00ebrkesave verifikuese, t\u00eb vendosura n\u00eb fush\u00ebn \u2018.request.object.annotations\u2019, z\u00ebvend\u00ebsohen drejtp\u00ebrdrejt n\u00eb konfigurimin nginx. Nd\u00ebrkoh\u00eb, konfigurimi i gjeneruar nuk aplikohet, por vet\u00ebm testohet duke ekzekutuar skedarin ekzekutiv \u2018nginx\u2019 me opsionin \u2018-t\u2019. <\/p>\n N\u00eb ve\u00e7anti, z\u00ebvend\u00ebsimi i t\u00eb dh\u00ebnave t\u00eb jashtme n\u00eb konfigurim kryhet p\u00ebr parametrat \u2018mirror-target\u2019, \u2018mirror-host\u2019 (CVE-2025-1098), \u2018auth-tls-match-cn\u2019 (CVE-2025-1097) dhe \u2018auth-url\u2019 (CVE-2025-24514). P\u00ebr shembull, n\u00eb rreshtin e konfigurimit \u2018set $target {{ $externalAuth.URL }};\u2019 n\u00eb vend t\u00eb \u2018{{ $externalAuth.URL }}\u2019 z\u00ebvend\u00ebsohet URL-ja e caktuar n\u00eb parametrin \u2018auth-url\u2019. Gjat\u00eb k\u00ebsaj, sakt\u00ebsia e URL-s\u00eb nuk kontrollohet. Si rezultat, sulmuesi mund t\u00eb d\u00ebrgoj\u00eb si URL nj\u00eb vler\u00eb t\u00eb till\u00eb si \u2018http:\/\/example.com\/#;\nsettings\u2019 dhe t\u00eb z\u00ebvend\u00ebsoj\u00eb cil\u00ebsimet e veta n\u00eb skedarin e konfigurimit. <\/p>\n P\u00ebr t\u00eb ekzekutuar kod t\u00eb arbitrash\u00ebm gjat\u00eb procesit t\u00eb verifikimit t\u00eb konfigurimit me komand\u00ebn \u2018nginx -t\u2019, k\u00ebrkuesit shfryt\u00ebzuan faktin se p\u00ebrve\u00e7 verifikimit t\u00eb sintaks\u00ebs, nginx ngarkon biblioteka me module dhe hap skedar\u00ebt e p\u00ebrmendur n\u00eb konfigurim p\u00ebr t\u00eb vler\u00ebsuar aksesueshm\u00ebrin\u00eb e tyre. Nd\u00ebr t\u00eb tjera, gjat\u00eb p\u00ebrpunimit t\u00eb direktiv\u00ebs ssl_engine, ngarkohet biblioteka e ndar\u00eb e specifikuar n\u00eb direktiv\u00eb. SSL<\/a>-motori. <\/p>\n P\u00ebr t\u00eb ngarkuar bibliotek\u00ebn e saj n\u00eb serverin Kubernetes, hulumtuesit shfryt\u00ebzuan (CVE-2025-1974) faktin q\u00eb gjat\u00eb p\u00ebrpunimit t\u00eb k\u00ebrkesave t\u00eb m\u00ebdha, nginx ruan trupin e k\u00ebrkes\u00ebs n\u00eb nj\u00eb skedar p\u00ebrkoh\u00ebsor, i cili menj\u00ebher\u00eb fshihet, por n\u00eb sistemin e skedar\u00ebve \u00ab\/proc\u00bb p\u00ebr k\u00ebt\u00eb skedar mbetet nj\u00eb deshifrues skedari i hapur. K\u00ebshtu, \u00ebsht\u00eb e mundur t\u00eb d\u00ebrgohen k\u00ebrkesa n\u00eb m\u00ebnyr\u00eb t\u00eb nj\u00ebkohshme p\u00ebr ruajtjen e skedarit p\u00ebrkoh\u00ebsor dhe fillimin e kontrollit t\u00eb konfigurimit, n\u00eb t\u00eb cilin n\u00eb direktiv\u00ebn \u00abssl_engine\u00bb \u00ebsht\u00eb p\u00ebrcaktuar rruga p\u00ebr deshifruesin n\u00eb sistemin e skedar\u00ebve \u00ab\/proc\u00bb. <\/p>\n P\u00ebr t\u00eb siguruar q\u00eb deshifruesi i skedarit t\u00eb mbetet i aksesuesh\u00ebm p\u00ebr nj\u00eb koh\u00eb t\u00eb gjat\u00eb, vlera \u00abContent-Length\u00bb n\u00eb k\u00ebrkes\u00eb mund t\u00eb p\u00ebrcaktohet si domosdo e madhe, p\u00ebr m\u00eb shum\u00eb se t\u00eb dh\u00ebnat e d\u00ebrguara n\u00eb t\u00eb v\u00ebrtet\u00eb (serveri do t\u00eb pres\u00eb p\u00ebr pranimin e t\u00eb dh\u00ebnave t\u00eb mbetura). Nj\u00eb kompleksitet shtes\u00eb \u00ebsht\u00eb nevoja p\u00ebr t\u00eb guess PID e procesit dhe numrin e deshifruesit t\u00eb skedarit t\u00eb lidhur me bibliotek\u00ebn e ndar\u00eb t\u00eb ngarkuar, por p\u00ebr shkak se n\u00eb kontejner zakonisht p\u00ebrdoret nj\u00eb num\u00ebr minimal i proceseve t\u00eb nisura, vlerat e nevojshme mund t\u00eb guessed n\u00ebp\u00ebrmjet provimeve t\u00eb shumta. N\u00eb rast suksesi dhe ngarkimi i bibliotek\u00ebs s\u00eb ndar\u00eb t\u00eb bashkuar, sulmuesi mund t\u00eb ket\u00eb qasje n\u00eb parametrat e ruajtur brenda mjedisit pod, t\u00eb mjaftuesh\u00ebm p\u00ebr t\u00eb kontrolluar t\u00eb gjith\u00eb klasterin.