# \[Security Advisory\] CVE-2021-25748: Ingress-nginx \`path\` sanitization can be bypassed with newline character

**URL:** <https://discuss.kubernetes.io/t/security-advisory-cve-2021-25748-ingress-nginx-path-sanitization-can-be-bypassed-with-newline-character/20280>\
**Category:** Announcements\
**Created:** [June 10, 2022, 4:09pm UTC](https://discuss.kubernetes.io/t/security-advisory-cve-2021-25748-ingress-nginx-path-sanitization-can-be-bypassed-with-newline-character/20280 "2022-06-10T16:09:32Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![CJ\_Cullen](https://sea2.discourse-cdn.com/flex016/user_avatar/discuss.kubernetes.io/cj_cullen/32/7616_2.png) [@CJ\_Cullen](https://discuss.kubernetes.io/u/CJ_Cullen)\
**Post date:** [June 10, 2022, 4:09pm UTC](https://discuss.kubernetes.io/t/security-advisory-cve-2021-25748-ingress-nginx-path-sanitization-can-be-bypassed-with-newline-character/20280/1 "2022-06-10T16:09:32Z")

</div>

### Issue Details

A security issue was discovered in [ingress-nginx](https://github.com/kubernetes/ingress-nginx) where a user that can create or update ingress objects can use a newline character to bypass the sanitization of the `spec.rules[].http.paths[].path` field of an Ingress object (in the `[networking.k8s.io](http://networking.k8s.io)` or `extensions` API group) to obtain the credentials of the ingress-nginx controller. In the default configuration, that credential has access to all secrets in the cluster.

This issue has been rated High ([CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L)), and assigned CVE-2021-25748.

### Affected Components and Configurations

This bug affects ingress-nginx. If you do not have ingress-nginx installed on your cluster, you are not affected. You can check this by running `kubectl get po -n ingress-nginx`.

If you are running the “chrooted” ingress-nginx controller introduced in v1.2.0 ([gcr.io/k8s-staging-ingress-nginx/controller-chroot](http://gcr.io/k8s-staging-ingress-nginx/controller-chroot)), you are not affected.

Multitenant environments where non-admin users have permissions to create Ingress objects are most affected by this issue.

### Affected Versions- \<v1.2.1

### Fixed Versions- v1.2.1

### Mitigation

If you are unable to roll out the fix, this vulnerability can be mitigated by implementing an admission policy that restricts the `spec.rules[].http.paths[].path` field on the [networking.k8s.io/Ingress](http://networking.k8s.io/Ingress) resource to known safe characters (see the newly added [rules](https://github.com/kubernetes/ingress-nginx/blame/main/internal/ingress/inspector/rules.go), or the suggested value for [annotation-value-word-blocklist](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#annotation-value-word-blocklist)).

### Detection

If you find evidence that this vulnerability has been exploited, please contact [security@kubernetes.io](mailto:security@kubernetes.io)

### Additional Details

See ingress-nginx Issue [#8686](https://github.com/kubernetes/ingress-nginx/issues/8686) for more details.

### Acknowledgements

This vulnerability was reported by Gafnit Amiga.

Thank You,

CJ Cullen on behalf of the Kubernetes Security Response Committee