IngressNightmare Detection Tool

Overview

This tool provides a non-intrusive detection capability for the IngressNightmare vulnerability chain (CVE-2025-1974) affecting Ingress NGINX Controller. It specifically leverages the auth-url annotation injection vector (CVE-2025-24514) to verify the presence of this critical vulnerability without executing arbitrary code.

Technical Background

The IngressNightmare vulnerability chain allows attackers to inject arbitrary NGINX configuration directives through various Ingress annotation fields. When these malicious Ingress resources are processed by the admission controller, the injected directives are evaluated during the NGINX configuration validation phase (nginx -t).

This PoC specifically exploits the auth-url annotation vulnerability by injecting the error_log directive with a syslog server pointing to an attacker-controlled domain. During configuration validation, NGINX will:

1. Parse the injected configuration
2. Resolve the specified domain via DNS

This DNS resolution activity provides a reliable signal that the target is vulnerable without requiring code execution or service disruption.