PT-2021-16766 · Unknown · Ingress-Nginx

Mitch Hulscher · Published 2021-10-26 · Updated 2024-06-15 · CVE-2021-25742

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions ingress-nginx versions prior to v0.49.1 and prior to v1.0.1

Description A security issue was discovered where a user with the ability to create or update ingress objects can use the custom snippets feature to obtain all secrets in the cluster. This is particularly critical in multitenant environments where non-admin users have permissions to create Ingress resources. The custom snippets feature allows a user to execute arbitrary code through Lua in Nginx, potentially leading to access to the serviceaccount token and secrets across all namespaces.

Recommendations To resolve the issue, update ingress-nginx to version >= v0.49.1 or >= v1.0.1. Additionally, set allow-snippet-annotations to false in the ConfigMap to prevent exploitation.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BIT-NGINX-INGRESS-CONTROLLER-2021-25742

CVE-2021-25742

OPENSUSE-SU-2024:11726-1

Affected Products

Ingress-Nginx

References · 13

• 🔥 https://github.com/kubernetes/ingress-nginx/issues/7837 · Exploit
• https://osv.dev/vulnerability/CVE-2021-25742 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-nginx-ingress-controller-2021-25742 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-25742 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:11726-1 · Vendor Advisory
• https://t.me/defcon_news/88551 · Telegram Post
• https://security.netapp.com/advisory/ntap-20211203-0001 · Note
• https://t.me/cvenotify/24155 · Telegram Post
• https://groups.google.com/g/kubernetes-security-announce/c/mT4JJxi9tQY · Note
• https://suse.com/security/cve/CVE-2021-25742 · Note
• https://t.me/cvenotify/22922 · Telegram Post
• https://t.me/rnetsec/15928 · Telegram Post
• https://t.me/k8security/426 · Telegram Post