NerdCulture

3 posts3 participants0 posts today

Lenin alevski 🕵️💻After my last post analyzing the NGINX <a href="https://infosec.exchange/tags/IngressNightmare" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#IngressNightmare</a> vulnerability, I’m excited to share a new addition to my Kubernetes Security: Advanced Exploitation series!Inspired by the excellent research from the Wiz team on CVE-2025-1974, I’ve created a hands-on lab that walks you through exploiting this issue step by step. You can try it out here: 🔗 <a href="https://github.com/Alevsk/dvka/tree/master/workshop/labs/ingress-nightmare" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://github.com/Alevsk/dvka/tree/master/workshop/labs/ingress-nightmare</a>This lab offers a safe environment to:1. Reproduce the vulnerability 2. Understand how the exploit works 👉 <a href="https://github.com/Alevsk/dvka/blob/master/workshop/labs/ingress-nightmare/cve-2025-1974.py" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://github.com/Alevsk/dvka/blob/master/workshop/labs/ingress-nightmare/cve-2025-1974.py</a> 3. Generate your own indicators of compromise (IOCs)It’s a great way to deepen your Kubernetes security knowledge and gain hands-on experience with real-world exploitation techniques. Have fun learning, and feel free to share any thoughts or questions!

IT NewsThis Week in Security: IngressNightmare, NextJS, and Leaking DNA - This week, researchers from Wiz Research released a series of vulnerabilities in t... - <a href="https://hackaday.com/2025/03/28/this-week-in-security-ingressnightmare-nextjs-and-leaking-dna/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://hackaday.com/2025/03/28/this-week-in-security-ingressnightmare-nextjs-and-leaking-dna/</a> <a href="https://schleuss.online/tags/thisweekinsecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#thisweekinsecurity</a> <a href="https://schleuss.online/tags/ingressnightmare" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ingressnightmare</a> <a href="https://schleuss.online/tags/hackadaycolumns" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#hackadaycolumns</a> <a href="https://schleuss.online/tags/securityhacks" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#securityhacks</a> <a href="https://schleuss.online/tags/23andme" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#23andme</a> <a href="https://schleuss.online/tags/nextjs" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#nextjs</a> <a href="https://schleuss.online/tags/news" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#news</a>

Matthias LuftI wrote up some details on exploiting <a href="https://infosec.exchange/tags/IngressNightmare" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#IngressNightmare</a> <a href="https://infosec.exchange/tags/CVE" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CVE</a>-2025-1974: www.averlon.ai/blog/kuberne...Where are we at with releasing a full PoC?

Bret MogilefskyAttention all k8s people: There's an <a href="https://hachyderm.io/tags/IngressNightmare" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#IngressNightmare</a> in progress. > "Based on our analysis, about 43% of cloud environments are vulnerable to these vulnerabilities, with our research uncovering over 6,500 clusters, including Fortune 500 companies, that publicly expose vulnerable Kubernetes ingress controllers’ admission controllers to the public internet—putting them at immediate critical risk." <a href="https://www.wiz.io/blog/ingress-nginx-kubernetes-vulnerabilities" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.wiz.io/blog/ingress-nginx-kubernetes-vulnerabilities</a>

Sam Stepanyan :verified: 🐘<a href="https://infosec.exchange/tags/NGINX" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#NGINX</a> Critical Ingress NGINX Controller for <a href="https://infosec.exchange/tags/Kubernetes" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Kubernetes</a> Vulnerability Allows <a href="https://infosec.exchange/tags/RCE" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#RCE</a> Without Authentication. A set of 5 critical security CVE with CVSS scores 4.8-9.8 affecting ~43% of cloud environments globally:<a href="https://infosec.exchange/tags/IngressNightmare" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#IngressNightmare</a><a href="https://thehackernews.com/2025/03/critical-ingress-nginx-controller.html" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://thehackernews.com/2025/03/critical-ingress-nginx-controller.html</a>

Xavier «X» Santolaria :verified_paw: :donor:⁉️ So, today are you more of a <a href="https://infosec.exchange/tags/ingressnightmare" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ingressnightmare</a> or <a href="https://infosec.exchange/tags/signalgate" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#signalgate</a> person?<a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#infosec</a> <a href="https://infosec.exchange/tags/uspol" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#uspol</a>

esaFiksene for CVE-ene involvert i <a href="https://snabelen.no/tags/ingressnightmare" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ingressnightmare</a> er jo også litt interessante:* CVE-2025-1097 mer quoting: <a href="https://github.com/kubernetes/ingress-nginx/pull/13068/commits/06c992abd8eef9710359a236c443c613d29fdfad" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://github.com/kubernetes/ingress-nginx/pull/13068/commits/06c992abd8eef9710359a236c443c613d29fdfad</a>* CVE-2025-1098 mer & flyttet quoting: <a href="https://github.com/kubernetes/ingress-nginx/pull/13068/commits/2e9f37380afb7853fa6daa1c3e6659550aadfd90" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://github.com/kubernetes/ingress-nginx/pull/13068/commits/2e9f37380afb7853fa6daa1c3e6659550aadfd90</a>* CVE-2025-1974 diverse utkommentert kode, tydeligvis tester?: <a href="https://github.com/kubernetes/ingress-nginx/pull/13068/commits/0ccf4caaadec919680c455d221e53d97970d527d" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://github.com/kubernetes/ingress-nginx/pull/13068/commits/0ccf4caaadec919680c455d221e53d97970d527d</a>* CVE-2025-24513 bruke en ordentlig filepath-type: <a href="https://github.com/kubernetes/ingress-nginx/pull/13068/commits/cbc159094f6d1b1bf8cf1761eb119138d1f95df1" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://github.com/kubernetes/ingress-nginx/pull/13068/commits/cbc159094f6d1b1bf8cf1761eb119138d1f95df1</a>* CVE-2025-24514 mer sitering: <a href="https://github.com/kubernetes/ingress-nginx/pull/13068/commits/ab470eb920924d62a197ebddd8a4cc3031a77ddf" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://github.com/kubernetes/ingress-nginx/pull/13068/commits/ab470eb920924d62a197ebddd8a4cc3031a77ddf</a>

Lenin alevski 🕵️💻I spent some time diving into the details of the recent NGINX (ingress-nginx) exploit publication — <a href="https://infosec.exchange/tags/IngressNightmare" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#IngressNightmare</a> — and here’s a simplified breakdown I put together:TL;DR: This attack targets NGINX by tricking it into executing a malicious configuration that leverages dangerous directives (like ssl_engine) to take over the Kubernetes Pod and escalate privileges.First things first, the attacker needs to be inside the Kubernetes perimeter and able to communicate with the ingress-nginx-controller Pod. This is more common than you’d think — many clusters are deployed without any network segmentation policies in place.From there, the attack unfolds in two phases: 1. Upload a malicious module to the file system of the ingress-nginx-controller Pod. 2. Send a configuration to ingress-nginx that uses the ssl_engine directive to load that malicious module.The brilliance of this attack lies in the details. Let me walk you through how it works:In the first step, the attacker exploits a feature called Client Body Buffers. When an HTTP request exceeds 8KB, NGINX starts writing the body to disk instead of keeping it in memory. To ensure the malicious module is properly staged for the next step, the attacker sets a Content-Length header that leaves the server “waiting” for more data.Then comes phase two: the attacker floods the ingress-nginx-controller with requests containing an AdmissionReview that includes a config using ssl_engine, pointing to the malicious module injected earlier (e.g., /proc/$PID/fd/$FD). Since the attacker doesn’t know the exact process ID or file descriptor, they brute-force it. But because containerized environments typically have very few processes, this brute-force step is trivial.Once the attacker guesses the correct combination, NGINX loads the malicious module — and just like that, command execution is achieved.From that point on, the attacker can use the container’s service account token to read secrets, access config files, move laterally, and ultimately take control of the entire cluster.<a href="https://www.wiz.io/blog/ingress-nginx-kubernetes-vulnerabilities" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.wiz.io/blog/ingress-nginx-kubernetes-vulnerabilities</a>

CHATONS<a href="https://forum.chatons.org/t/critical-ingress-nginx-vulnerability-for-kubernetes/7171/1" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://forum.chatons.org/t/critical-ingress-nginx-vulnerability-for-kubernetes/7171/1</a><a href="https://framapiaf.org/tags/IngressNightmare" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#IngressNightmare</a> <a href="https://framapiaf.org/tags/kubernetes" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#kubernetes</a> <a href="https://framapiaf.org/tags/ingress_nginx" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ingress_nginx</a> <a href="https://framapiaf.org/tags/CVE" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CVE</a>-2025-24514 <a href="https://framapiaf.org/tags/CVE" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CVE</a>-2025-1097 <a href="https://framapiaf.org/tags/CVE" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CVE</a>-2025-1098 CVE-2025-1974 <a href="https://framapiaf.org/tags/cvss9" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cvss9</a>.8

Recent searches

Search options

Administered by:

Server stats:

#ingressnightmare