Critical NGINX Ingress Controller Vulnerabilities in Kubernetes: Safeguarding Sensitive Data Amidst Evolving Threats

As technology advances, the significance of robust cybersecurity measures has never been more crucial. Recently, security researchers unveiled three severe vulnerabilities in the NGINX Ingress controller for Kubernetes, spotlighting potential threats that could compromise sensitive data within the cluster.

CVE-2022-4886 (CVSS score: 8.8) – Ingress-nginx path sanitization can be bypassed to obtain the credentials of the ingress-nginx controller.

CVE-2023-5043 (CVSS score: 7.6) – Ingress-nginx annotation injection causes arbitrary command execution.

CVE-2023-5044 (CVSS score: 7.6) – Code injection via below annotation: nginx.ingress.kubernetes.io/permanent-redirect annotation.

CVE-2022-4886, CVE-2023-5043, and CVE-2023-5044, if left unaddressed, could lead to catastrophic consequences. Exploitable by malicious actors, these vulnerabilities enable unauthorized data access and code injection, exposing confidential credentials and breaching the integrity of the Ingress controller process.

With a focus on proactive security, the NGINX Ingress controller maintainers have swiftly introduced temporary mitigation strategies. Activating the “strict-validate-path-type” option and the “–enable-annotation-validation” flag can impede the creation of Ingress objects with invalid characters, fortifying the system against potential attacks.

Armoryze advises updating NGINX to latest version 1.9.0, coupled with implementing the “–enable-annotation-validation” command-line configuration to effectively address CVE-2023-5043 and CVE-2023-5044. Stressing the interconnected nature of these vulnerabilities, Armoryze underscores the necessity of proactive measures to counteract the privileged scope of Ingress controllers and their vulnerability to external cyber threats.

In a constantly evolving digital landscape, organizations must prioritize robust risk-based vulnerability management strategies. By implementing comprehensive security measures, businesses can effectively safeguard their sensitive data and ensure the integrity of their technological infrastructure.

Keen to learn more? Follow us on LinkedIn for exclusive insights and updates. Contact us today for a FREE consultation with our cybersecurity experts.

Source References:
1. https://nvd.nist.gov/vuln/detail/CVE-2022-4886
2. https://nvd.nist.gov/vuln/detail/CVE-2023-5043
3. https://nvd.nist.gov/vuln/detail/CVE-2023-5044
4. https://github.com/kubernetes/ingress-nginx/issues/10572