CVE-2025-24514

This exploit demonstrates a file descriptor injection vulnerability in the Ingress-NGINX Admission Controller, leading to remote code execution by uploading a malicious shared object and brute-forcing file descriptors.

This repository contains a functional exploit for CVE-2025-24514, targeting unauthenticated RCE in the Ingress NGINX Controller for Kubernetes. The exploit compiles a malicious shared object, uploads it via a crafted HTTP request with mismatched Content-Length, and brute-forces file descriptors to trigger execution.

This repository contains a functional exploit for CVE-2025-1974, targeting Kubernetes ingress-nginx. The exploit leverages a vulnerability in the handling of HTTP requests to achieve remote code execution by manipulating temporary files and admission webhook configurations.

This repository contains a functional exploit for CVE-2025-24514, targeting a Kubernetes Ingress vulnerability. The exploit uses a crafted AdmissionReview request with a malicious payload to achieve remote code execution (RCE) on vulnerable systems.

This repository contains a Python-based scanner for CVE-2025-24514, which targets an ingress-nginx vulnerability allowing NGINX configuration manipulation via the `auth-url` annotation. The PoC sends a crafted HTTP request to detect potential vulnerability by checking for specific strings in the response.