Vulnerability Details : CVE-2021-25748
A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use a newline character to bypass the sanitization of the `spec.rules[].http.paths[].path` field of an Ingress object (in the `networking.k8s.io` or `extensions` API group) to obtain the credentials of the ingress-nginx controller. In the default configuration, that credential has access to all secrets in the cluster.
Vulnerability category: Input validation
Products affected by CVE-2021-25748
- cpe:2.3:a:kubernetes:ingress-nginx:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2021-25748
0.06%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 23 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2021-25748
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
7.6
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L |
2.8
|
4.7
|
Kubernetes | |
|
6.5
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
2.8
|
3.6
|
NIST |
CWE ids for CVE-2021-25748
-
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.Assigned by: jordan@liggitt.net (Secondary)
References for CVE-2021-25748
-
https://github.com/kubernetes/ingress-nginx/issues/8686
CVE-2021-25748: Ingress-nginx `path` sanitization can be bypassed with newline character · Issue #8686 · kubernetes/ingress-nginx · GitHubIssue Tracking;Mitigation;Vendor Advisory
-
https://groups.google.com/g/kubernetes-security-announce/c/avaRYa9c7I8
[Security Advisory] CVE-2021-25748: Ingress-nginx `path` sanitization can be bypassed with newline characterMailing List;Mitigation;Vendor Advisory
Jump to