CVE-2023-5044: Kubernetes Ingress-nginx RCE Vulnerability

CVE-2023-5044 Overview

CVE-2023-5044 is a code injection vulnerability in Kubernetes Ingress-nginx that allows attackers to inject arbitrary code through the nginx.ingress.kubernetes.io/permanent-redirect annotation. This vulnerability stems from improper input validation (CWE-20) and code injection weaknesses (CWE-94), enabling malicious actors with the ability to create or modify Ingress objects to execute arbitrary commands within the context of the Ingress-nginx controller.

Critical Impact

Attackers with access to create or modify Ingress resources can inject malicious code through the permanent-redirect annotation, potentially compromising the entire Kubernetes cluster's network traffic routing and gaining unauthorized access to sensitive data and services.

Affected Products

• Kubernetes Ingress-nginx (all versions prior to patch)
• Kubernetes clusters utilizing Ingress-nginx controller for traffic management
• Cloud-native environments with exposed Ingress resources

Discovery Timeline

• 2023-10-25 - CVE-2023-5044 published to NVD
• 2025-02-13 - Last updated in NVD database

Technical Details for CVE-2023-5044

Vulnerability Analysis

The vulnerability exists in the Kubernetes Ingress-nginx controller's handling of the nginx.ingress.kubernetes.io/permanent-redirect annotation. When processing Ingress resources, the controller fails to properly sanitize user-supplied input in this annotation before incorporating it into the nginx configuration. This improper input validation allows an attacker who can create or modify Ingress objects to inject arbitrary nginx configuration directives or Lua code that executes within the controller's context.

The attack requires low privileges (PR:L) as the attacker needs permissions to create or modify Kubernetes Ingress resources, but once achieved, the impact spans confidentiality, integrity, and availability of the affected system. The vulnerability is exploitable over the network without user interaction, making it particularly dangerous in multi-tenant Kubernetes environments.

Root Cause

The root cause of CVE-2023-5044 lies in insufficient input validation and sanitization of the permanent-redirect annotation value. The Ingress-nginx controller directly processes annotation values and incorporates them into the generated nginx configuration without adequately escaping or validating the content. This allows specially crafted annotation values containing nginx configuration syntax or Lua code to be interpreted as legitimate configuration rather than data, leading to code injection.

Attack Vector

The attack vector leverages network access to the Kubernetes API server. An attacker with permissions to create or modify Ingress resources can craft a malicious Ingress manifest that includes a specially crafted nginx.ingress.kubernetes.io/permanent-redirect annotation. When the Ingress-nginx controller processes this resource, the injected code is incorporated into the nginx configuration and executed.

The exploitation flow typically involves:

1. Attacker gains access to create or modify Ingress resources (via compromised credentials, misconfigured RBAC, or insider access)
2. Attacker creates an Ingress resource with a malicious permanent-redirect annotation containing injected nginx directives or Lua code
3. The Ingress-nginx controller processes the annotation without proper sanitization
4. The malicious configuration is loaded into nginx, executing the attacker's code

This vulnerability does not have verified public exploits available. For technical details on the vulnerability mechanism, refer to the GitHub Issue #10572 and the Kubernetes Security Announcement.

Detection Methods for CVE-2023-5044

Indicators of Compromise

• Unusual or malformed nginx.ingress.kubernetes.io/permanent-redirect annotations in Ingress resources
• Unexpected nginx configuration changes in the Ingress-nginx controller pods
• Anomalous network traffic patterns from the Ingress-nginx controller
• Kubernetes audit logs showing modifications to Ingress resources with suspicious annotation content

Detection Strategies

• Monitor Kubernetes audit logs for creation or modification of Ingress resources, specifically tracking changes to the permanent-redirect annotation
• Implement admission controller policies to validate and restrict annotation values on Ingress resources
• Deploy runtime security monitoring to detect unusual process execution or network connections from Ingress-nginx controller pods
• Use SentinelOne Singularity Platform to detect code injection attempts and anomalous behavior in containerized workloads

Monitoring Recommendations

• Enable verbose logging on the Ingress-nginx controller to capture configuration generation events
• Configure alerts for Kubernetes API events related to Ingress resource mutations
• Implement continuous scanning of Ingress resources for potentially malicious annotation patterns
• Utilize SentinelOne's Kubernetes workload protection to monitor for runtime exploitation attempts

How to Mitigate CVE-2023-5044

Immediate Actions Required

• Review all existing Ingress resources for suspicious permanent-redirect annotations
• Implement Kubernetes RBAC policies to restrict who can create or modify Ingress resources
• Deploy admission webhooks to validate annotation content before Ingress resources are created
• Upgrade Ingress-nginx controller to the latest patched version as soon as available

Patch Information

Kubernetes has acknowledged this vulnerability and users should monitor the GitHub Issue #10572 and the Kubernetes Security Announcement for official patch releases and version upgrade guidance. Additional context is available in the NetApp Security Advisory NTAP-20240307-0012.

Workarounds

• Implement strict RBAC policies to limit Ingress resource creation to trusted operators only
• Use OPA Gatekeeper or Kyverno policies to validate and sanitize annotation values on Ingress resources
• Consider network segmentation to limit the blast radius if the Ingress-nginx controller is compromised
• Monitor the Openwall OSS-Security Discussion for additional mitigation guidance from the security community

# Example Kubernetes RBAC policy to restrict Ingress modifications
kubectl create clusterrole ingress-viewer --verb=get,list,watch --resource=ingresses
kubectl create clusterrolebinding restricted-ingress-access --clusterrole=ingress-viewer --group=developers
# Only grant ingress modification rights to trusted administrators
kubectl create clusterrole ingress-admin --verb=get,list,watch,create,update,patch,delete --resource=ingresses
kubectl create clusterrolebinding admin-ingress-access --clusterrole=ingress-admin --group=cluster-admins