CVE-2021-25746: Kubernetes Ingress-nginx Disclosure Flaw

CVE-2021-25746 Overview

A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use .metadata.annotations in an Ingress object (in the networking.k8s.io or extensions API group) to obtain the credentials of the ingress-nginx controller. In the default configuration, that credential has access to all secrets in the cluster.

Critical Impact
Authenticated users with ingress creation privileges can steal ingress-nginx controller credentials, potentially gaining access to all Kubernetes secrets in the cluster.

Affected Products

Kubernetes ingress-nginx (vulnerable versions)

Discovery Timeline

2022-05-06 - CVE CVE-2021-25746 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-25746

Vulnerability Analysis

This vulnerability stems from improper input validation (CWE-20) in the Kubernetes ingress-nginx controller's handling of annotation metadata. The ingress-nginx controller processes annotations specified in Ingress objects to configure NGINX behavior. However, a flaw in how these annotations are validated and processed allows an attacker to inject malicious content that can be leveraged to extract sensitive controller credentials.

When an Ingress object is created or updated, the ingress-nginx controller reads and processes the .metadata.annotations field. An attacker with permissions to create or modify Ingress resources can craft specific annotation values that exploit the parsing logic, leading to credential exposure. In the default Kubernetes RBAC configuration, the ingress-nginx controller service account typically has broad read access to secrets across all namespaces, making this vulnerability particularly dangerous.

Root Cause

The root cause is improper input validation (CWE-20) in the annotation processing logic of the ingress-nginx controller. The controller fails to adequately sanitize or restrict the content of certain annotation values, allowing attackers to inject payloads that result in credential disclosure. This is a classic case of trusting user-supplied input without proper validation in a security-sensitive context.

Attack Vector

The attack vector is network-based and requires low-privilege authenticated access. An attacker needs the ability to create or update Ingress objects within the Kubernetes cluster, which is a permission commonly granted to developers and service accounts. The attack does not require user interaction and can be performed remotely.

The attacker crafts an Ingress object with specially constructed .metadata.annotations that exploit the annotation processing logic. When the ingress-nginx controller processes this Ingress object, the malicious annotations trigger the credential exposure mechanism, allowing the attacker to retrieve the controller's service account token or other sensitive credentials.

In the default configuration, these credentials provide access to all secrets in the cluster, enabling the attacker to escalate their access significantly—potentially reading database passwords, API keys, TLS certificates, and other sensitive information stored as Kubernetes secrets.

Detection Methods for CVE-2021-25746

Indicators of Compromise

Unusual or malformed annotations in Ingress objects, particularly those containing special characters or escape sequences
Unexpected Ingress object creation or modification by non-standard users or service accounts
Anomalous API calls to read secrets from namespaces outside the typical scope of an application
Ingress objects with suspicious annotation patterns targeting controller configuration

Detection Strategies

Implement Kubernetes audit logging and monitor for Ingress object creation and update events with unusual annotation content
Deploy admission controllers (such as OPA Gatekeeper or Kyverno) to validate and restrict annotation content in Ingress objects
Monitor ingress-nginx controller logs for errors or warnings related to annotation processing
Use security scanning tools to identify Ingress objects with potentially malicious annotation patterns

Monitoring Recommendations

Enable and centralize Kubernetes audit logs with focus on Ingress resource operations
Set up alerts for Ingress objects created or modified by unexpected users or service accounts
Monitor for secret access patterns that deviate from established baselines
Implement runtime security monitoring to detect credential theft attempts from controller pods

How to Mitigate CVE-2021-25746

Immediate Actions Required

Upgrade ingress-nginx to a patched version as specified in the Kubernetes Security Announcement
Review all existing Ingress objects for suspicious or unexpected annotations
Implement RBAC restrictions to limit which users and service accounts can create or modify Ingress objects
Consider applying admission policies to validate annotation content before Ingress objects are created

Patch Information

Kubernetes has released security patches addressing this vulnerability. Refer to the GitHub Issue Discussion and the Kubernetes Security Announcement for specific version information and upgrade instructions. The NetApp Security Advisory also provides additional guidance for affected NetApp products.

Workarounds

Restrict Ingress creation permissions to trusted administrators only using Kubernetes RBAC
Deploy admission controllers to validate and sanitize Ingress annotations before they are processed
Reduce the permissions of the ingress-nginx controller service account to follow the principle of least privilege
Network segment the ingress-nginx controller to limit the impact of potential credential theft

bash

# Example: Restrict ingress-nginx controller service account permissions
# Create a more restrictive ClusterRole that limits secret access
kubectl create clusterrole ingress-nginx-restricted \
  --verb=get,list,watch \
  --resource=secrets \
  --resource-name=<specific-secrets-only>

# Bind the restrictive role to the ingress-nginx service account
kubectl create clusterrolebinding ingress-nginx-restricted-binding \
  --clusterrole=ingress-nginx-restricted \
  --serviceaccount=ingress-nginx:ingress-nginx