CVE-2025-1974

White Hat School 3rd Cohort - [Kim So-eun (@salt318)] (https://github.com/salt318/vulhub)

Summary

• Caused by a defect in the Ingress-NGINX Admission Controller, a core security mechanism of Kubernetes
• The Ingress-NGINX Admission Controller is exposed to the network without authentication
• This allows an attacker to craft malicious AdmissionReview requests and inject unauthorized configurations into Ingress resources
• When combined with other vulnerabilities, remote code execution may be possible (CVE-2025-24514, CVE-2025-1097 or CVE-2025-1098)

Environment Setup and Execution

• Run docker compose up -d to start the test environment (K3s-based Kubernetes environment)
• Compile the malicious shell code
  root@kitploit:~

  gcc -shared -fPIC -o shell.so shell.c
  

• Exploit the vulnerability using the command below
  root@kitploit:~

  python exploit.py -a https://localhost:30443/networking/v1/ingresses -i http://localhost:30080/fake/addr -s shell.so
  

Execution Result

Conclusion

The lack of authentication vulnerability in the Ingress-NGINX Admission Controller allows the injection of malicious Ingress resources or system control, and when combined with other vulnerabilities, can lead to remote code execution (RCE). Therefore, security measures such as strengthening authentication and authorization verification for Admission Controller access, reinforcing Ingress resource validation logic, and blocking external access through network ACL (Access Control List) settings should be applied.