This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.
[TLP:CLEAR] Kubernetes ingress-nginx fixes 1 vulnerability
Kubernetes fixes a vulnerability in ingress-nginx in version 1.11.2. The use of the ingress-nginx controller in your instance can be verified by running the command "kubectl get po -A" and searching for the string "ingress-nginx-controller". Compromise of the system can be verified by searching the Kubernetes audit logs for the creation of ingress objects with an annotation containing the '\r' (carriage return) character [1].
An authenticated remote attacker with permissions to create ingress objects in the API groups "networking.k8s.io" or "extensions" can execute arbitrary commands and thereby obtain credentials for the ingress-nginx controller, through which all secrets can be accessed [1]. A PoC has been published for the vulnerability [2].
The vulnerability is present in product:
- Kubernetes ingress-nginx; <1.11.2;
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2024-7646 at cve.org, NVD
- CWE-20: Improper Input Validation at cwe.mitre.org
The vulnerability was publicly disclosed 16. 8. 2024.
Links
By CESNET, z.s.p.o. Martin Krajči on 19. 8. 2024.