oss-security - [kubernetes] CVE-2021-25748: Ingress-nginx `path` sanitization can be bypassed with newline character

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <CABdrxGBr+uS70N8OhVvLZ=qW8EaGLJkA84Q0vAjQ3tpv6bdX0Q@mail.gmail.com>
Date: Fri, 10 Jun 2022 09:11:47 -0700
From: CJ Cullen <cjcullen@...gle.com>
To: oss-security@...ts.openwall.com
Subject: [kubernetes] CVE-2021-25748: Ingress-nginx `path` sanitization can be
 bypassed with newline character

Issue Details

A security issue was discovered in ingress-nginx
<https://github.com/kubernetes/ingress-nginx> where a user that can create
or update ingress objects can use a newline character to bypass the
sanitization of the `spec.rules[].http.paths[].path` field of an Ingress
object (in the `networking.k8s.io` or `extensions` API group) to obtain the
credentials of the ingress-nginx controller. In the default configuration,
that credential has access to all secrets in the cluster.

This issue has been rated High (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
<https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L>),
and assigned CVE-2021-25748.
Affected Components and Configurations

This bug affects ingress-nginx. If you do not have ingress-nginx installed
on your cluster, you are not affected. You can check this by running
`kubectl get po -n ingress-nginx`.

If you are running the “chrooted” ingress-nginx controller introduced in
v1.2.0 (gcr.io/k8s-staging-ingress-nginx/controller-chroot), you are not
affected.

Multitenant environments where non-admin users have permissions to create
Ingress objects are most affected by this issue.
Affected Versions

   -

   <v1.2.1

Fixed Versions

   -

   v1.2.1

Mitigation

If you are unable to roll out the fix, this vulnerability can be mitigated
by implementing an admission policy that restricts the
`spec.rules[].http.paths[].path` field on the networking.k8s.io/Ingress
resource to known safe characters (see the newly added rules
<https://github.com/kubernetes/ingress-nginx/blame/main/internal/ingress/inspector/rules.go>,
or the suggested value for annotation-value-word-blocklist
<https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#annotation-value-word-blocklist>
).
Detection

If you find evidence that this vulnerability has been exploited, please
contact security@...ernetes.io
Additional Details

See ingress-nginx Issue #8686
<https://github.com/kubernetes/ingress-nginx/issues/8686> for more details.
Acknowledgements

This vulnerability was reported by Gafnit Amiga.

Thank You,

CJ Cullen on behalf of the Kubernetes Security Response Committee

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.