CVE-2023-5043
📋 TL;DR
This CVE allows attackers to inject malicious annotations into Ingress nginx configurations, leading to arbitrary command execution on the host system. It affects Kubernetes clusters using ingress-nginx controller with vulnerable versions. Attackers can potentially gain control over the underlying node.
💻 Affected Systems
- ingress-nginx
- Kubernetes ingress-nginx controller
📦 What is this software?
Ingress Nginx by Kubernetes
⚠️ Risk & Real-World Impact
Worst Case
Full compromise of the Kubernetes node, allowing lateral movement to other pods and nodes, data exfiltration, and persistent backdoor installation.
Likely Case
Container escape leading to host system compromise, enabling privilege escalation and access to sensitive cluster resources.
If Mitigated
Limited impact if proper network segmentation, least privilege, and annotation validation are implemented.
🎯 Exploit Status
Exploitation requires ability to create/modify Ingress resources with malicious annotations. Public proof-of-concept exists in security advisories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.9.0, 1.8.2, 1.7.2, or 1.6.4
Vendor Advisory: https://groups.google.com/g/kubernetes-security-announce/c/pVsXsOpxYZo
Restart Required: Yes
Instructions:
1. Update ingress-nginx controller to patched version. 2. Update deployment: kubectl set image deployment/ingress-nginx-controller controller=registry.k8s.io/ingress-nginx/controller:v1.9.0. 3. Verify pods restart successfully.
🔧 Temporary Workarounds
Restrict Ingress Creation
allLimit who can create/modify Ingress resources using Kubernetes RBAC
kubectl create role ingress-creator --verb=create,update --resource=ingresses
kubectl create rolebinding ingress-binding --role=ingress-creator --user=trusted-user
Annotation Validation
allUse admission controllers to validate annotations before they're applied
kubectl apply -f validating-webhook-configuration.yaml
🧯 If You Can't Patch
- Implement strict RBAC to limit Ingress resource creation/modification to trusted users only
- Deploy network policies to isolate ingress-nginx controller and limit lateral movement
🔍 How to Verify
Check if Vulnerable:
Check ingress-nginx controller version: kubectl get pods -n ingress-nginx -l app.kubernetes.io/name=ingress-nginx -o jsonpath='{.items[*].spec.containers[*].image}'Check Version:
kubectl get pods -n ingress-nginx -l app.kubernetes.io/name=ingress-nginx -o jsonpath='{.items[*].spec.containers[*].image}' | grep -E 'v1\.(9\.0|8\.2|7\.2|6\.4)'Verify Fix Applied:
Verify controller is running patched version and test annotation injection attempts are blocked📡 Detection & Monitoring
Log Indicators:
- Unusual annotation patterns in Ingress resources
- Suspicious commands executed in ingress-nginx pods
- Unexpected pod creation from ingress-nginx namespace
Network Indicators:
- Unexpected outbound connections from ingress-nginx pods
- Lateral movement attempts from ingress-nginx namespace
SIEM Query:
source="kubernetes" AND (resource.type="ingress" AND annotation contains suspicious_pattern) OR (pod.name contains "ingress-nginx" AND log contains "exec" OR "command")🔗 References
- http://www.openwall.com/lists/oss-security/2023/10/25/4
- https://github.com/kubernetes/ingress-nginx/issues/10571
- https://groups.google.com/g/kubernetes-security-announce/c/pVsXsOpxYZo
- https://security.netapp.com/advisory/ntap-20240307-0012/
- http://www.openwall.com/lists/oss-security/2023/10/25/4
- https://github.com/kubernetes/ingress-nginx/issues/10571
- https://groups.google.com/g/kubernetes-security-announce/c/pVsXsOpxYZo
- https://security.netapp.com/advisory/ntap-20240307-0012/
