Ingress in Kubernetes manages external traffic to internal services through Ingress resources YAML files defining routing rules by hostname or path and an Ingress Controller, such as the NGINX variant, which enforces these rules via a reverse proxy. A recently discovered set of vulnerabilities, dubbed “IngressNightmare,” found in Ingress NGINX Controller, exposing clusters to unauthenticated remote code execution (RCE). Ingress also poses operational issues: SSL errors need secret and DNS validation; routing problems require log and endpoint checks; and performance bottlenecks benefit from scaling replicas and adjusting proxy settings like proxy-buffer-size: “8k”. IngressNightmare encompasses four vulnerabilities in the Ingress NGINX Controller’s admission webhook, which validates Ingress objects. In Kubernetes, Ingress serves as a sophisticated traffic management system, enabling external access to internal services. According to the report, The controller generates an NGINX configuration incorporating the injected code, and during validation with nginx -t, the malicious directives such as loading a rogue library execute, achieving RCE. The Ingress NGINX Controller, built on the popular NGINX web server, is one of the most widely deployed options, boasting over 18,000 stars on GitHub. They then craft a malicious Ingress object, embedding harmful NGINX directives into annotations like auth-url or auth-tls-match-cn.
This Cyber News was published on cybersecuritynews.com. Publication date: Sat, 05 Apr 2025 07:45:11 +0000