Issue Details
A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use .metadata.annotations in an Ingress object (in the [networking.k8s.io](http://networking.k8s.io) or extensions API group) to obtain the credentials of the ingress-nginx controller. In the default configuration, that credential has access to all secrets in the cluster.
This issue has been rated High (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L), and assigned CVE-2021-25746.
Affected Components and Configurations
This bug affects ingress-nginx. If you do not have ingress-nginx installed on your cluster, you are not affected. You can check this by running kubectl get po -n ingress-nginx.
Multitenant environments where non-admin users have permissions to create Ingress objects are most affected by this issue.
Affected Versions- <v1.2.0
Fixed Versions- v1.2.0-beta.0
- v1.2.0
Mitigation
If you are unable to roll out the fix, this vulnerability can be mitigated by implementing an admission policy that restricts the metadata.annotations values to known safe (see the newly added rules, or the suggested value for annotation-value-word-blocklist).
Detection
If you find evidence that this vulnerability has been exploited, please contact security@kubernetes.io
Additional Details
See ingress-nginx Issue #8503 for more details.
Acknowledgements
This vulnerability was reported by Anthony Weems, and separately by jeffrey&oliver.
Thank You,
CJ Cullen on behalf of the Kubernetes Security Response Committee