CVE-2021-25748 : Security Advisory and Response

A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use a newline character to bypass the sanitization of the

spec.rules[].http.paths[].path

field of an Ingress object. This could lead to obtaining credentials of the ingress-nginx controller with access to all secrets in the cluster.

Understanding CVE-2021-25748

Ingress-nginx

path

sanitization can be bypassed with a newline character.

What is CVE-2021-25748?

CVE-2021-25748 is a security vulnerability found in ingress-nginx that allows users to manipulate the

path

field of an Ingress object by using a newline character, thereby bypassing sanitization and potentially accessing sensitive credentials.

The Impact of CVE-2021-25748

The impact of this vulnerability is rated as HIGH, with a base score of 7.6 (HIGH severity) according to the CVSSv3.1 metrics. It can lead to unauthorized access to sensitive information within a Kubernetes cluster.

Technical Details of CVE-2021-25748

This section provides detailed technical information about the vulnerability.

Vulnerability Description

The vulnerability lies in the ingress-nginx component where improper input validation allows the manipulation of the

path

field, providing unauthorized access to sensitive credentials.

Affected Systems and Versions

Kubernetes ingress-nginx versions less than 1.2.1 are affected. The vulnerability impacts all instances where the

networking.k8s.io

or

extensions

API group is utilized.

Exploitation Mechanism

By injecting a newline character into the

spec.rules[].http.paths[].path

field of an Ingress object, threat actors can obtain credentials of the ingress-nginx controller bypassing necessary sanitization.

Mitigation and Prevention

Protecting systems from CVE-2021-25748 is crucial in securing Kubernetes environments.

Immediate Steps to Take

Immediate action involves upgrading Kubernetes ingress-nginx to version 1.2.1 or higher and enforcing strict input validation mechanisms to prevent unauthorized access.

Long-Term Security Practices

Implement robust security measures, regularly audit ingress configurations, and monitor for any unauthorized access attempts to prevent similar vulnerabilities in the future.

Patching and Updates

Ensure timely patches and updates are applied to Kubernetes ingress-nginx to mitigate the risk of exploitation.