CVE-2024-7646
HIGHKubernetes ingress-nginx - Unauthenticated Command Injection via Ingress Annotation Bypass
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2024-7646. PoCs published by dovics, r0binak.
AI-analyzed exploit summary This PoC exploits CVE-2024-7646 in ingress-nginx to inject Lua code via the `auth-tls-verify-client` annotation, bypassing restrictions on `server-snippet`. It reads the Kubernetes service account token and exposes it via an HTTP endpoint, enabling privilege escalation.
Description
A security issue was discovered in ingress-nginx where an actor with permission to create Ingress objects (in the `networking.k8s.io` or `extensions` API group) can bypass annotation validation to inject arbitrary commands and obtain the credentials of the ingress-nginx controller. In the default configuration, that credential has access to all secrets in the cluster.
Exploits (2)
This PoC exploits CVE-2024-7646 in ingress-nginx to inject Lua code via the `auth-tls-verify-client` annotation, bypassing restrictions on `server-snippet`. It reads the Kubernetes service account token and exposes it via an HTTP endpoint, enabling privilege escalation.
This PoC demonstrates a header injection vulnerability in Kubernetes Ingress NGINX, allowing arbitrary HTTP headers to be injected via the `server-snippet` annotation, leading to potential XSS or response splitting attacks.
References (5)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H