CVE-2025-1098
HIGH NUCLEIKubernetes ingress-nginx mirror annotations - Controller Code Execution
Title source: manualExploitation Summary
EIP tracks 4 public exploits for CVE-2025-1098. PoCs published by Beatriz Fresno Naumova, hakaioffsec, Esonhugh. A Nuclei detection template is also available.
AI-analyzed exploit summary This exploit demonstrates a file descriptor injection vulnerability in the Ingress-NGINX Admission Controller, leading to remote code execution by uploading a malicious shared object and brute-forcing file descriptors.
Description
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `mirror-target` and `mirror-host` Ingress annotations can be used to inject arbitrary configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)
Exploits (4)
This exploit demonstrates a file descriptor injection vulnerability in the Ingress-NGINX Admission Controller, leading to remote code execution by uploading a malicious shared object and brute-forcing file descriptors.
This repository contains a functional exploit for CVE-2025-1098, targeting unauthenticated RCE in the Ingress NGINX Controller for Kubernetes. The exploit compiles a malicious shared object, uploads it via a crafted HTTP request with mismatched Content-Length, and brute-forces file descriptors to trigger execution.
This repository contains a functional exploit for CVE-2025-1907, targeting Kubernetes ingress-nginx. The exploit leverages a vulnerability in the handling of HTTP requests to achieve remote code execution by manipulating temporary files and admission webhook configurations.
This repository contains a functional exploit for CVE-2025-1098, targeting a Kubernetes Ingress vulnerability. The exploit uses a crafted AdmissionReview request to achieve remote code execution (RCE) via a base64-encoded payload.
Nuclei Templates (1)
ssl:"ingress-nginx" port:8443
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H