CVE-2022-4886
📋 TL;DR
This vulnerability allows attackers to bypass path sanitization in ingress-nginx by using the log_format directive, potentially enabling path traversal attacks. It affects Kubernetes ingress-nginx deployments where custom log formats are configured. Attackers could access restricted files or directories.
💻 Affected Systems
- ingress-nginx
📦 What is this software?
Ingress Nginx by Kubernetes
⚠️ Risk & Real-World Impact
Worst Case
Full path traversal allowing access to sensitive system files, configuration files, or source code from the nginx container.
Likely Case
Limited path traversal within the container filesystem, potentially exposing application configuration or secrets.
If Mitigated
No impact if proper network segmentation and container security controls prevent lateral movement.
🎯 Exploit Status
Exploitation requires sending specially crafted HTTP requests to bypass path sanitization.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.8.2
Vendor Advisory: https://groups.google.com/g/kubernetes-security-announce/c/ge7u3qCwZLI
Restart Required: Yes
Instructions:
1. Update ingress-nginx to version 1.8.2 or later. 2. Update the ingress-nginx controller deployment. 3. Verify the new version is running.
🔧 Temporary Workarounds
Remove custom log_format directives
linuxRemove any custom log_format configurations from ingress-nginx to eliminate the vulnerability vector.
kubectl edit configmap ingress-nginx-controller
Remove log_format entries from nginx-configuration
🧯 If You Can't Patch
- Implement network segmentation to restrict ingress-nginx access to trusted sources only.
- Deploy WAF rules to detect and block path traversal attempts in HTTP requests.
🔍 How to Verify
Check if Vulnerable:
Check if ingress-nginx version is below 1.8.2 and has custom log_format configurations.Check Version:
kubectl describe pod -n ingress-nginx | grep ImageVerify Fix Applied:
Verify ingress-nginx version is 1.8.2 or higher and test path traversal attempts are blocked.📡 Detection & Monitoring
Log Indicators:
- Unusual path patterns in nginx access logs
- Failed path traversal attempts in error logs
Network Indicators:
- HTTP requests with encoded path traversal sequences
- Multiple 403/404 responses for unusual paths
SIEM Query:
source="nginx" AND (uri="*..%2f*" OR uri="*%2e%2e%2f*")🔗 References
- http://www.openwall.com/lists/oss-security/2023/10/25/5
- https://github.com/kubernetes/ingress-nginx/issues/10570
- https://groups.google.com/g/kubernetes-security-announce/c/ge7u3qCwZLI
- https://security.netapp.com/advisory/ntap-20240307-0013/
- http://www.openwall.com/lists/oss-security/2023/10/25/5
- https://github.com/kubernetes/ingress-nginx/issues/10570
- https://groups.google.com/g/kubernetes-security-announce/c/ge7u3qCwZLI
- https://security.netapp.com/advisory/ntap-20240307-0013/
