Summary
A security issue was discovered in ingress-nginx where the nginx.ingress.kubernetes.io/auth-proxy-set-headers Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. In the default installation, the controller can access all Secrets cluster-wide.
Impact
An authenticated attacker with permission to create or modify Ingress resources can supply a malicious ConfigMap reference via the nginx.ingress.kubernetes.io/auth-proxy-set-headers annotation to inject arbitrary nginx directives. Successful exploitation results in arbitrary code execution within the ingress-nginx controller process and potential disclosure of all Kubernetes Secrets accessible to the controller, which in the default installation includes all Secrets across every namespace.
Detection
Suspicious data within a ConfigMap passed to the nginx.ingress.kubernetes.io/auth-proxy-set-headers annotation of an Ingress resource could indicate an attempt to exploit this vulnerability. Audit Ingress resource definitions across all namespaces and review any ConfigMaps referenced by this annotation for unexpected content. If you find evidence that this vulnerability has been exploited, contact security@kubernetes.io.
To confirm whether ingress-nginx is installed in your cluster, run:
kubectl get pods --all-namespaces --selector app.kubernetes.io/name=ingress-nginx
Mitigation
Upgrade ingress-nginx to v1.12.5, v1.13.1, or any later version. Follow the Upgrading Ingress-nginx documentation for upgrade procedures.