Hachyderm.io

0 posts0 participants0 posts today

🛡 H3lium@infosec.exchange/:~# :blinking_cursor:"🚨 NGINX Ingress Vulnerabilities Exposed! 🚨"Three new vulnerabilities have been identified in the NGINX ingress controller for Kubernetes. These vulnerabilities, tagged as CVE-2023-5043, CVE-2023-5044, and CVE-2022-4886, could potentially allow attackers to steal secret credentials from the cluster. 🕵️‍♂️🔓<ul><li>CVE-2023-5043 & CVE-2023-5044: These vulnerabilities can be exploited by attackers who can control the Ingress object's configuration. By using the annotation fields “configuration-snippet” or “permanent-redirect”, attackers can inject arbitrary code into the ingress controller process, gaining access to the service account token of the ingress controller. This token has a ClusterRole, enabling reading of all Kubernetes secrets in the cluster. 😱</li><li>CVE-2022-4886: This vulnerability lies in the way the “path” field is used in the Ingress routing definitions. A flaw in the validation of the inner path can lead to exposure of the service account token, which is used for authentication against the API server. 🚫</li></ul>Mitigation steps include updating NGINX to version 1.19 and enabling the “--enable-annotation-validation” command line configuration. 🛡️These vulnerabilities underscore the importance of securing ingress controllers, given their high privilege scope and potential exposure to external traffic.Source: <a href="https://www.armosec.io/blog/cve-2023-5043-nginx-ingress/" rel="nofollow noopener noreferrer" target="_blank">ARMO Blog</a> by Ben Hirschberg, CTO & Co-founder.Tags: <a href="https://infosec.exchange/tags/NGINX" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#NGINX</a> <a href="https://infosec.exchange/tags/Kubernetes" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Kubernetes</a> <a href="https://infosec.exchange/tags/Vulnerability" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Vulnerability</a> <a href="https://infosec.exchange/tags/CyberSecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CyberSecurity</a> <a href="https://infosec.exchange/tags/IngressController" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#IngressController</a> <a href="https://infosec.exchange/tags/CVE2023" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CVE2023</a> <a href="https://infosec.exchange/tags/CVE2022" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CVE2022</a> 🌐🔐🔍

Volkan ÖzçelikContour is a high performance ingress controller for Kubernetes<a href="https://projectcontour.io/" rel="nofollow noopener noreferrer" target="_blank">https://projectcontour.io/</a><a href="https://z2h.dev/tags/Kubernetes" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Kubernetes</a> <a href="https://z2h.dev/tags/ingress" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ingress</a> <a href="https://z2h.dev/tags/IngressController" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#IngressController</a> <a href="https://z2h.dev/tags/infra" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#infra</a>

DenisÇa fait plusieurs fois qu'on en parle ici, je déconseille l'implémentation de l'<a href="https://framapiaf.org/tags/IngressController" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#IngressController</a> avec nginx sur le repo officiel de Kubernetes🔽🔽🔽<a href="https://blog.zwindler.fr/2022/11/14/je-deconseille-nginx-ingresscontroller-en-production/" rel="nofollow noopener noreferrer" target="_blank">https://blog.zwindler.fr/2022/11/14/je-deconseille-nginx-ingresscontroller-en-production/</a>

Recent searches

Search options

Administered by:

Server stats:

#IngressController