CVE-2021-25745: Kubernetes Ingress-nginx Info Disclosure

CVE-2021-25745 Overview

A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use the spec.rules[].http.paths[].path field of an Ingress object (in the networking.k8s.io or extensions API group) to obtain the credentials of the ingress-nginx controller. In the default configuration, that credential has access to all secrets in the cluster.

Critical Impact

An attacker with privileges to create or update Ingress objects can exploit this vulnerability to steal ingress-nginx controller credentials, potentially gaining access to all Kubernetes secrets cluster-wide.

Affected Products

• Kubernetes ingress-nginx

Discovery Timeline

• May 6, 2022 - CVE CVE-2021-25745 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2021-25745

Vulnerability Analysis

This vulnerability is classified as an Improper Input Validation issue (CWE-20) affecting the Kubernetes ingress-nginx controller. The flaw exists in how the ingress-nginx controller processes the path field within Ingress object specifications. When a malicious user crafts a specially designed Ingress object with a manipulated spec.rules[].http.paths[].path field, they can extract sensitive credentials from the ingress-nginx controller.

The attack is particularly dangerous because the default ingress-nginx controller configuration grants the controller's service account broad access to Kubernetes secrets across the entire cluster. This means successful exploitation could result in complete compromise of all secrets stored in the Kubernetes cluster.

Root Cause

The root cause of this vulnerability stems from insufficient input validation on the path field within Ingress object specifications. The ingress-nginx controller fails to properly sanitize or validate the spec.rules[].http.paths[].path field before processing it, allowing attackers to inject malicious content that results in credential disclosure.

This improper input validation allows the path field to be leveraged as an attack vector to access internal controller credentials that should not be exposed to users with Ingress object creation privileges.

Attack Vector

The attack vector is network-based and requires low privileges (the ability to create or update Ingress objects in the Kubernetes cluster). No user interaction is required. An attacker with the necessary Kubernetes RBAC permissions can craft malicious Ingress objects with specially crafted path values.

The exploitation flow involves:

1. The attacker creates or modifies an Ingress object with a malicious path value
2. The ingress-nginx controller processes the Ingress object without proper validation
3. The path field manipulation causes credential leakage
4. The attacker captures the ingress-nginx controller credentials
5. Using these credentials, the attacker can access all Kubernetes secrets in the cluster

For technical details on the specific exploitation mechanism, refer to the GitHub Issue #8502 and the Kubernetes Security Announcement.

Detection Methods for CVE-2021-25745

Indicators of Compromise

• Unusual Ingress objects with abnormal or suspicious path field values
• Unexpected access to Kubernetes secrets from ingress-nginx controller service account
• Audit logs showing creation or modification of Ingress objects with non-standard path configurations
• Anomalous network activity from the ingress-nginx controller pod

Detection Strategies

• Enable Kubernetes audit logging and monitor for Ingress object creation/modification events with suspicious path values
• Implement admission controllers (e.g., OPA Gatekeeper, Kyverno) to validate Ingress path fields against known malicious patterns
• Monitor ingress-nginx controller logs for unusual path processing behavior
• Use SentinelOne Singularity Cloud Workload Protection to detect anomalous container behavior

Monitoring Recommendations

• Configure alerting on Kubernetes audit logs for Ingress resource modifications
• Monitor secret access patterns from the ingress-nginx controller service account
• Implement runtime security monitoring for the ingress-nginx controller pods
• Review RBAC permissions regularly to identify users with Ingress creation privileges

How to Mitigate CVE-2021-25745

Immediate Actions Required

• Upgrade ingress-nginx to a patched version as specified in the security advisory
• Review and restrict RBAC permissions for Ingress object creation and modification
• Audit existing Ingress objects for suspicious path field values
• Consider implementing admission controllers to validate Ingress specifications

Patch Information

Kubernetes has released security patches to address this vulnerability. Refer to the GitHub Issue #8502 for specific version information and upgrade instructions. Additionally, consult the Kubernetes Security Announcement for official guidance. The NetApp Security Advisory NTAP-20220609-0006 also provides relevant information for affected deployments.

Workarounds

• Restrict RBAC permissions to limit which users can create or update Ingress objects
• Implement admission webhooks to validate and sanitize Ingress path fields before they are processed
• Apply the principle of least privilege to the ingress-nginx controller service account, limiting its access to secrets
• Consider network policies to restrict communication paths for the ingress-nginx controller

# Example: Restrict ingress-nginx service account permissions
# Create a more restrictive ClusterRole that limits secret access
kubectl create clusterrole ingress-nginx-restricted \
  --verb=get,list,watch \
  --resource=secrets \
  --resource-name=specific-allowed-secrets