Kubernetes Security: Critical NGINX Ingress Controller Flaws
Kubernetes ingress-nginx flaws CVE-2022-4886, CVE-2023-5043 and CVE-2023-5044 can expose credentials to attackers with Ingress object access or control. Upgrade versions older than v1.8.0 to v1.8.0 for CVE-2022-4886, and versions older than v1.9.0 to v1.9.0 for the other two; administrators should also activate --enable-annotation-validation for annotation restrictions.
Summary written with AI from this article, and checked against it.
Affected systems and impact
| Flaw | Affected systems | Impact |
|---|---|---|
| CVE-2022-4886Path sanitization bypass through inadequate validation of spec.rules[].http.paths[].path | Kubernetes ingress-nginx versions older than v1.8.0 | Attackers with Ingress object access can potentially extract Kubernetes API credentials |
| CVE-2023-5043Annotation injection in Ingress-nginx | Kubernetes ingress-nginx versions older than v1.9.0 | Attackers controlling Ingress object configuration can execute arbitrary commands and steal secret credentials |
| CVE-2023-5044Code injection via the nginx.ingress.kubernetes.io/permanent-redirect annotation | Kubernetes ingress-nginx versions older than v1.9.0 | Attackers controlling Ingress object configuration can gain unauthorized access to secret credentials |
Recent findings have uncovered three high-severity vulnerabilities in the NGINX Ingress controller for Kubernetes. These vulnerabilities, if exploited, could allow malicious actors to access and steal sensitive credentials from Kubernetes clusters.
Detailed Overview of the Vulnerabilities
CVE-2022-4886
- Risk Score: 8.8
- Issue: Bypass of path sanitization in Ingress-nginx leading to unauthorized access to ingress controller credentials.
- Cause: Inadequate validation in the 'spec.rules[].http.paths[].path' field.
- Impact: Potential extraction of Kubernetes API credentials by attackers with Ingress object access.
CVE-2023-5043
- Risk Score: 7.6
- Issue: Annotation injection in Ingress-nginx enabling arbitrary command execution.
- Impact: Attacker manipulation of the Ingress object's configuration to steal secret credentials.
CVE-2023-5044
- Risk Score: 7.6
- Issue: Code injection via the 'nginx.ingress.kubernetes.io/permanent-redirect' annotation.
- Impact: Unauthorized access to secret credentials by attackers controlling the Ingress object's configuration.
Affected Products and Versions
- Affected Component: ingress-nginx
- CVE-2022-4886: Versions older than v1.8.0
- CVE-2023-5043 and CVE-2023-5044: Versions older than v1.9.0
Recommended Solutions
CVE-2022-4886
- Version Update: Upgrade to version v1.8.0
- Mitigations: Employ stricter validation on the pathType field in Ingress objects and implement countermeasures for trusted user access.
CVE-2023-5043 and CVE-2023-5044
- Version Update: Upgrade to version v1.9.0
- Mitigations: Ingress Administrators should activate the --enable-annotation-validation flag to enforce restrictions on annotation fields.
Final Thoughts and Recommendations
The discovery of these vulnerabilities in the NGINX Ingress controller for Kubernetes emphasizes the criticality of maintaining stringent cybersecurity practices in Kubernetes environments. Given the elevated privileges of ingress controllers and their exposure to the public internet, it is crucial for administrators to stay vigilant, promptly apply updates, and implement robust security measures.
Ingress controllers are key components in Kubernetes clusters, often managing sensitive data and facilitating external traffic into the cluster. The recent vulnerabilities highlight the need for comprehensive security strategies, including regular system updates, strict validation rules, and proactive monitoring to safeguard Kubernetes clusters from emerging cyber threats.
Interview flashcards
What causes CVE-2022-4886 in ingress-nginx, and what can an attacker gain?
Inadequate validation of spec.rules[].http.paths[].path allows a path sanitization bypass. Attackers with Ingress object access could extract Kubernetes API credentials.
How does CVE-2023-5043 expose credentials in ingress-nginx?
Annotation injection enables arbitrary command execution. An attacker can manipulate the Ingress object's configuration to steal secret credentials.
Which annotation is vulnerable in CVE-2023-5044, and what is the impact?
The nginx.ingress.kubernetes.io/permanent-redirect annotation permits code injection. Attackers controlling the Ingress object's configuration could gain unauthorized access to secret credentials.
Which ingress-nginx versions are affected by these vulnerabilities, and which upgrades are recommended?
CVE-2022-4886 affects versions older than v1.8.0, with an upgrade to v1.8.0 recommended. CVE-2023-5043 and CVE-2023-5044 affect versions older than v1.9.0, with an upgrade to v1.9.0 recommended.
What mitigations are recommended for CVE-2022-4886 besides upgrading?
Employ stricter validation on the pathType field in Ingress objects and implement countermeasures for trusted user access.
How can Ingress administrators restrict annotation fields to mitigate CVE-2023-5043 and CVE-2023-5044?
Activate the --enable-annotation-validation flag to enforce restrictions on annotation fields.
Why is securing Kubernetes ingress controllers particularly important?
Ingress controllers have elevated privileges and exposure to the public internet. They often manage sensitive data and facilitate external traffic into the cluster.
Written with AI from this article, and checked against it.
About the author
Vishal · Software & security engineerVishal writes Trickyworld's tutorials and interview-preparation guides on programming, databases, cyber security and AI. Vishal has been shipping production software long enough to have firm opinions about Python, PHP, Node.js, and JavaScript, and to have been wrong about each of them at least once. The work has run the whole stack: Drupal and Laravel applications, React front ends, MySQL and MongoDB underneath, Redis and Memcached for the things that had to be fast, Apache Solr for the things that had to be findable. That last part turned out to matter more than anyone expected. Tune a Solr index for a season, then watch a language model confidently retrieve the wrong document, and you recognise an old problem wearing new clothes. Most of what is hard about AI systems is not the model. It is retrieval, caching, latency budgets, and deciding what the system does when the answer comes back wrong — which is work he has been doing since well before anyone called it AI engineering. He plays a lot of games, which is less a hobby disclosure than an admission of where a good share of his engineering instinct came from. Real-time systems with a frame budget. State that has to stay coherent while a player does something no designer anticipated. The permanent question of what happens when the frame cannot finish in time. Those habits carry over more directly than they have any right to. He has written several books on programming, all built on the same conviction: most technical writing is unclear because the author never decided what to leave out. More from Vishal → · Editorial policy
