CVE-2024-7646

HIGH
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2024-7646 has a selected CVSS score of 8.8 (high); EIP currently links 2 repository PoCs and 1 curated repository PoC.

Description

A security issue was discovered in ingress-nginx where an actor with permission to create Ingress objects (in the `networking.k8s.io` or `extensions` API group) can bypass annotation validation to inject arbitrary commands and obtain the credentials of the ingress-nginx controller. In the default configuration, that credential has access to all secrets in the cluster.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
2
Curated repository PoCs
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Aug 19, 2024 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

ingress-nginx

Browse Kubernetes / ingress-nginx

Default status: affected, unknown

CVE List1.11.0 to < 1.11.2affected
1.11.2unaffected
1.10.4unaffected
Before 1.10.4affected
1.11.2affected
1.10.4affected

Proofs of concept

3

Curated repository PoCs

GitHubCVE-2025-15566Curated repository PoCby exploitintel8Exploit19 files

C · 122.0 KiB · linked to 10 vulnerabilities

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact contains a Python script (poc/poc.py) that sends an HTTP GET request to a vulnerable nginx server's injected /pwned endpoint to trigger remote code execution via a Lua code block, executing OS commands like 'id' and 'hostname' and reading files.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of documentation, a lab setup guide, and two Python PoC scripts for CVE-2025-15566. The scripts demonstrate a legitimate nginx configuration injection vulnerability by sending HTTP requests to a locally running lab container and by simulating the vulnerable Go template function. No concealed executable behavior, operator-directed harm, persistence, credential theft, or unrelated payloads were observed. The scripts' actions are fully explained by the documented exploit chain and are consistent with normal PoC behavior for the stated CVE.

ClassificationExploit
Model confidence100%
AuthenticationNot required
LanguagesPython
Target softwareingress-nginx
Attack typesCode InjectionRemote Code Execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The primary artifact, poc/poc.py, is designed to send a malicious HTTP request to trigger and verify the execution of injected Lua code on a remote server, which constitutes an exploit. The script's main purpose is to exercise the vulnerability, not just detect it.

poc/poc.py:2-6poc/poc.py:127-135CVE-LAB.md:9

Requirements

  • A vulnerable nginx instance with a pre-rendered configuration containing an injected /pwned Lua endpoint must be running and network-accessible.poc/poc.py:15-24CVE-LAB.md:14-17

Observed behavior

  • Sends an HTTP GET request to the /pwned endpoint on the target server.poc/poc.py:136-141
  • Parses the HTTP response body for evidence of command execution, such as the output of the 'id' command (e.g., 'uid=101(www-data)').poc/poc.py:152-166
  • Reports success if evidence of remote code execution is found in the response.poc/poc.py:230-231
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Network Connection
Payload withheldThe PoC script poc.py connects to a locally running lab container to verify the target is alive and to trigger the documented RCE endpoint.poc/poc.py:80
Network Connection
Payload withheldThe PoC script poc.py checks for the existence of an injected nginx location as evidence of the configuration injection vulnerability.poc/poc.py:104
Network Connection
Payload withheldThe PoC script poc.py triggers the injected Lua RCE payload to demonstrate arbitrary command execution, which is the core of the CVE-2025-15566 exploit.poc/poc.py:136
Process Execution
Payload withheldThe PoC script poc.py uses payload withheld to dynamically resolve the IP address of the vulnerable lab container on the worker network.poc/poc.py:49-50
Process Execution
Payload withheldThe PoC script poc_vector2_template_injection.py retrieves Go unit test output from the lab container to provide evidence of the vulnerable function.poc/poc_vector2_template_injection.py:178-180
Review boundaries

What the analysis did not establish

  • The evidence packet reports complete_artifact_coverage as false, indicating that not all files from the repository unit were included in the analysis. The analysis is based on the 5 selected text files provided.
  • The exploit targets a lab environment with a pre-rendered vulnerable configuration, not a live, unmodified ingress-nginx controller.
  • The review is limited to the 5 text files provided in the evidence packet. 14 unclassified files totaling 72,353 bytes were present in the artifact but were not analyzed as they were flagged as binary or non-text media. The analysis scope confirms complete coverage for the selected readable text, but the artifact coverage is incomplete overall.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Repository PoCs

GitHubr0binak/CVE-2024-7646Repository PoCby r0binak0Not analyzed1 file

586 B

GitHub
PoC details
GitHubdovics/cve-2024-7646Repository PoCby dovics1Not analyzed3 files

2.3 KiB

GitHub
PoC details

References

6