CVE-2021-25746: Kubernetes Ingress-nginx Disclosure Flaw

CVE-2021-25746 Overview

A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use .metadata.annotations in an Ingress object (in the networking.k8s.io or extensions API group) to obtain the credentials of the ingress-nginx controller. In the default configuration, that credential has access to all secrets in the cluster.

Critical Impact

Authenticated users with ingress creation privileges can steal ingress-nginx controller credentials, potentially gaining access to all Kubernetes secrets in the cluster.

Affected Products

• Kubernetes ingress-nginx (vulnerable versions)

Discovery Timeline

• 2022-05-06 - CVE CVE-2021-25746 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-25746

Vulnerability Analysis

This vulnerability stems from improper input validation (CWE-20) in the Kubernetes ingress-nginx controller's handling of annotation metadata. The ingress-nginx controller processes annotations specified in Ingress objects to configure NGINX behavior. However, a flaw in how these annotations are validated and processed allows an attacker to inject malicious content that can be leveraged to extract sensitive controller credentials.

When an Ingress object is created or updated, the ingress-nginx controller reads and processes the .metadata.annotations field. An attacker with permissions to create or modify Ingress resources can craft specific annotation values that exploit the parsing logic, leading to credential exposure. In the default Kubernetes RBAC configuration, the ingress-nginx controller service account typically has broad read access to secrets across all namespaces, making this vulnerability particularly dangerous.

Root Cause

The root cause is improper input validation (CWE-20) in the annotation processing logic of the ingress-nginx controller. The controller fails to adequately sanitize or restrict the content of certain annotation values, allowing attackers to inject payloads that result in credential disclosure. This is a classic case of trusting user-supplied input without proper validation in a security-sensitive context.

Attack Vector

The attack vector is network-based and requires low-privilege authenticated access. An attacker needs the ability to create or update Ingress objects within the Kubernetes cluster, which is a permission commonly granted to developers and service accounts. The attack does not require user interaction and can be performed remotely.

The attacker crafts an Ingress object with specially constructed .metadata.annotations that exploit the annotation processing logic. When the ingress-nginx controller processes this Ingress object, the malicious annotations trigger the credential exposure mechanism, allowing the attacker to retrieve the controller's service account token or other sensitive credentials.

In the default configuration, these credentials provide access to all secrets in the cluster, enabling the attacker to escalate their access significantly—potentially reading database passwords, API keys, TLS certificates, and other sensitive information stored as Kubernetes secrets.

Detection Methods for CVE-2021-25746

Indicators of Compromise

• Unusual or malformed annotations in Ingress objects, particularly those containing special characters or escape sequences
• Unexpected Ingress object creation or modification by non-standard users or service accounts
• Anomalous API calls to read secrets from namespaces outside the typical scope of an application
• Ingress objects with suspicious annotation patterns targeting controller configuration

Detection Strategies

• Implement Kubernetes audit logging and monitor for Ingress object creation and update events with unusual annotation content
• Deploy admission controllers (such as OPA Gatekeeper or Kyverno) to validate and restrict annotation content in Ingress objects
• Monitor ingress-nginx controller logs for errors or warnings related to annotation processing
• Use security scanning tools to identify Ingress objects with potentially malicious annotation patterns

Monitoring Recommendations

• Enable and centralize Kubernetes audit logs with focus on Ingress resource operations
• Set up alerts for Ingress objects created or modified by unexpected users or service accounts
• Monitor for secret access patterns that deviate from established baselines
• Implement runtime security monitoring to detect credential theft attempts from controller pods

How to Mitigate CVE-2021-25746

Immediate Actions Required

• Upgrade ingress-nginx to a patched version as specified in the Kubernetes Security Announcement
• Review all existing Ingress objects for suspicious or unexpected annotations
• Implement RBAC restrictions to limit which users and service accounts can create or modify Ingress objects
• Consider applying admission policies to validate annotation content before Ingress objects are created

Patch Information

Kubernetes has released security patches addressing this vulnerability. Refer to the GitHub Issue Discussion and the Kubernetes Security Announcement for specific version information and upgrade instructions. The NetApp Security Advisory also provides additional guidance for affected NetApp products.

Workarounds

• Restrict Ingress creation permissions to trusted administrators only using Kubernetes RBAC
• Deploy admission controllers to validate and sanitize Ingress annotations before they are processed
• Reduce the permissions of the ingress-nginx controller service account to follow the principle of least privilege
• Network segment the ingress-nginx controller to limit the impact of potential credential theft

# Example: Restrict ingress-nginx controller service account permissions
# Create a more restrictive ClusterRole that limits secret access
kubectl create clusterrole ingress-nginx-restricted \
  --verb=get,list,watch \
  --resource=secrets \
  --resource-name=<specific-secrets-only>

# Bind the restrictive role to the ingress-nginx service account
kubectl create clusterrolebinding ingress-nginx-restricted-binding \
  --clusterrole=ingress-nginx-restricted \
  --serviceaccount=ingress-nginx:ingress-nginx