Summary
A security issue was discovered in ingress-nginx where a combination of Ingress annotations can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. In the default installation, the controller can access all Secrets cluster-wide.
Impact
An authenticated attacker with permission to create or modify Ingress resources can exploit annotation combinations to inject arbitrary nginx directives into the controller configuration. Successful exploitation results in arbitrary code execution within the ingress-nginx controller process. Because the controller has access to all Secrets in the cluster by default, exploitation can lead to full cluster-wide credential disclosure.
Detection
Suspicious data within the rules.http.paths.path field of an Ingress resource could indicate an attempt to exploit this vulnerability. Audit Ingress resource definitions across all namespaces for unexpected or obfuscated values. If you find evidence that this vulnerability has been exploited, contact security@kubernetes.io.
To confirm whether ingress-nginx is installed in your cluster, run:
kubectl get pods --all-namespaces --selector app.kubernetes.io/name=ingress-nginx
Mitigation
Upgrade ingress-nginx to v1.13.9, v1.14.5, or v1.15.1 (matching your deployed version branch) or any later release. Follow the Upgrading Ingress-nginx documentation for upgrade procedures.