DEMO

https://youtu.be/3hYlHeaf2mQ

What is CVE-2025-1974?

CVE-2025-1974 (IngressNightmare) is a critical (CVSS 9.8) unauthenticated Remote Code Execution vulnerability in the Kubernetes ingress-nginx admission controller.

Attack Flow:

1. Upload: Send malicious shared library (.so file) to NGINX via HTTP POST
2. Inject: Send crafted Ingress-related manifests (AdmissionReview) with the annotation that injects the ssl_engine directive
3. Execute: Admission controller runs nginx -t which loads and executes the malicious .so

Impact:

• Arbitrary code execution in the ingress-nginx controller pod
• Access to all cluster Secrets (by leveraging the default RBAC)
• Complete cluster compromise potential

Affected Versions

• All versions < v1.11.5
• v1.11.0 - v1.11.4
• v1.12.0

How to run it

Step 1: Perform the setup

Run the provided ./setup_cve_env script. It will install all the required tools (minikube, kubectl, helm) and create a one-node minikube cluster. Then a vulnerable version of the NGINX ingress-controller will be deployed to the cluster, together with an attacker pod that will use the controller admission webhook to send the payload.

Step 2: Trigger the exploit

1. Get the IP of the ingress-controller pod

WEBHOOK_IP=$(kubectl get pod -n ingress-nginx -l app.kubernetes.io/component=controller -o jsonpath='{.items[0].status.podIP}')

2. Trigger the exploit

kubectl exec attacker -- python3 /tmp/exploit.py $WEBHOOK_IP

3. Check

The response error logs will show CVE-2025-1974 RCE TRIGGERED. Also, the error logs will exfiltrate secrets, as the ingress controller pod has access to all the cluster secrets.

The .so payload will also create a pwned file. Check its presence with:

kubectl exec -n ingress-nginx $CPOD -- ls -l /tmp/pwned

References

CVE entry
Wiz report
Kubernetes response