CVE-2025-1097
HIGH NUCLEIKubernetes ingress-nginx auth-tls-match-cn - Controller Code Execution
Title source: manualExploitation Summary
EIP tracks 4 public exploits for CVE-2025-1097. PoCs published by Beatriz Fresno Naumova, hakaioffsec, Esonhugh. A Nuclei detection template is also available.
AI-analyzed exploit summary This exploit demonstrates a file descriptor injection vulnerability in the Ingress-NGINX Admission Controller, leading to remote code execution by uploading a malicious shared object and brute-forcing file descriptors.
Description
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-tls-match-cn` Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)
Exploits (4)
This exploit demonstrates a file descriptor injection vulnerability in the Ingress-NGINX Admission Controller, leading to remote code execution by uploading a malicious shared object and brute-forcing file descriptors.
This repository contains a functional exploit for CVE-2025-1097, targeting unauthenticated RCE in the Ingress NGINX Controller for Kubernetes. The exploit compiles a shared object with a reverse shell payload, uploads it via a manipulated HTTP request, and brute-forces file descriptors to trigger execution.
This repository contains a functional exploit for CVE-2025-1907, targeting Kubernetes ingress-nginx. The exploit leverages a vulnerability in the handling of HTTP requests to achieve remote code execution by manipulating temporary files and admission webhook configurations.
This PoC exploits CVE-2025-1097, a vulnerability in Kubernetes Ingress, by sending a maliciously crafted AdmissionReview request. The exploit uses a base64-encoded payload to achieve remote code execution (RCE) on the target system.
Nuclei Templates (1)
ssl:"ingress-nginx" port:8443
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H