🔥 CVE-2025-24514 Remote Vulnerability Check PoC

This script is a Python-based PoC that can remotely check for the CVE-2025-24514 vulnerability (NGINX configuration manipulation and potential RCE through auth-url injection in ingress-nginx).

---

🧠 Vulnerability Overview

• CVE-2025-24514 is a vulnerability in the Kubernetes Ingress Controller ingress-nginx where NGINX configuration is unintentionally injected via the nginx.ingress.kubernetes.io/auth-url annotation.
• Including a malicious path (/;error_log /dev/stdout;) can corrupt the NGINX configuration file, allowing arbitrary command execution or information leakage.

---

✅ PoC Key Features

• Sends an HTTP request to the target server to attempt auth-url configuration injection
• Determines vulnerability by checking for error_log or auth-url strings in the response
• Compatible with Windows CMD, PowerShell, Linux/Bash
• Supports colored output via colorama

---

📦 Installation and Execution

1. Python Installation

Python 3.x environment is required.

2. Install Dependencies

bash pip install requests colorama```

3. Run PoC

bash python cve_2025_24514_remote_poc.py

---

🖥️ Execution Example

[=] CVE-2025-24514 Remote Vulnerability Check PoC Start =

[?] Enter the target server URL/IP (e.g., http://192.168.0.0): http://192.168.0.0 [+] Sending malicious request to target: http://192.168.0.0 [+] HTTP response code: 200 [+] Response content (first 300 characters):

Welcome... [!!!] Very likely vulnerable: Suspected NGINX configuration exposure

---

🔍 Vulnerability Conditions

For this PoC to work, some of the following conditions must be met:

The target server is running Ingress-NGINX controller with external access

The auth-url annotation is processed without filtering

Reverse proxy operation based on the request Host header is applied

---

⚠️ Notes

This script should only be used for security testing and audit purposes.

Unauthorized testing may result in legal liability.

Servers found vulnerable should immediately apply security patches or annotation filtering.

---

🔧 Mitigation Measures

Update ingress-nginx to the latest version

Apply user input validation for auth-url and auth-signin annotations

Block URI patterns that allow configuration injection from external requests

---

📄 References

Nginx Ingress Controller GitHub

CVE Details - CVE-2025-24514

Ingress-NGINX Vulnerability Security Advisory

---

📫 Contact

Please submit bug reports or suggestions via email or PR.

---

📝 License

This project is licensed under the MIT License - see the LICENSE file for details. Copyright (c) 2025 KimJuhyeong95