CVE-2025-1098

This repository contains a functional exploit for CVE-2025-1098, targeting unauthenticated RCE in the Ingress NGINX Controller for Kubernetes. The exploit compiles a malicious shared object, uploads it via a crafted HTTP request with mismatched Content-Length, and brute-forces file descriptors to trigger execution.

This repository contains a functional exploit for CVE-2025-1907, targeting Kubernetes ingress-nginx. The exploit leverages a vulnerability in the handling of HTTP requests to achieve remote code execution by manipulating temporary files and admission webhook configurations.

This repository contains a functional exploit for CVE-2025-1098, targeting a Kubernetes Ingress vulnerability. The exploit uses a crafted AdmissionReview request to achieve remote code execution (RCE) via a base64-encoded payload.

This exploit demonstrates a file descriptor injection vulnerability in the Ingress-NGINX Admission Controller, leading to remote code execution by uploading a malicious shared object and brute-forcing file descriptors.