cve-2025-1974-win11-attack-defense-lab

Windows 11-first educational repository for studying CVE-2025-1974 in a safe, non-weaponized ATTACK + DEFENSE lab. The project is designed for university coursework, team demos, and report-ready screenshots. It emphasizes clean-room implementation, local-only validation, and a red-team-style attack emulation that never becomes a real exploit.

This lab encodes the official baseline that CVE-2025-1974 affects ingress-nginx, with affected versions < 1.11.0, 1.11.0 through 1.11.4, and 1.12.0; fixed versions 1.11.5, 1.12.1, and later releases. It also reflects the official temporary mitigation of disabling the Validating Admission Controller until an upgrade is completed.

Why This Project Uses Attack Emulation

This repository intentionally does not implement, port, or operationalize exploit code. Instead, it provides a safe attack-flow emulator that demonstrates the stages a defender would reason about:

• environment fingerprinting
• attack-path reasoning
• harmless request-flow emulation
• mitigation comparison
• evidence packaging

The attack path is represented through sanitized fixtures, local state, and simulator stage markers only. No malicious AdmissionReview payloads, code execution payloads, shells, config injection, or exploit delivery mechanisms are included.

Architecture

flowchart LR
    A["PowerShell Wrappers<br/>Windows 11-first UX"] --> B["Python CLI<br/>app.main"]
    B --> C["Preflight Checks<br/>Windows, Docker, kubectl, kind, Python 3.11"]
    B --> D["Cluster Assessment<br/>kind + kubectl on localhost"]
    B --> E["Attack Simulator<br/>sanitized fixtures only"]
    B --> F["Mitigation Checks<br/>version + admission state"]
    B --> G["Detections<br/>lab-specific simulated indicators"]
    E --> H["reports/attack_simulation.log"]
    F --> I["reports/defense_scan.json"]
    G --> J["reports/timeline.csv + timeline.json"]
    H --> K["Markdown Report Writer"]
    I --> K
    J --> K
    K --> L["reports/latest-report.md"]

Project Overview

• Track A: Attack Emulation Runs a screenshot-friendly simulator that behaves like an attacker workflow without performing exploitation.
• Track B: Defense Validation Performs real local checks against a disposable lab cluster and assesses version and mitigation posture.
• Windows 11-first Every major workflow has a PowerShell wrapper and Python 3.11 CLI equivalent.
• Reporting Generates Markdown, JSON, CSV, and console transcripts suitable for class submission and demonstrations.

Windows 11 Setup

Assumptions

• Windows 11 host
• PowerShell 7+
• Python 3.11
• Docker Desktop
• kubectl
• kind

Recommended setup flow

pwsh ./scripts/setup-win11.ps1
pwsh ./scripts/start-lab.ps1
pwsh ./scripts/run-defend-scan.ps1
pwsh ./scripts/run-attack-sim.ps1
pwsh ./scripts/generate-report.ps1

Quick Start

Python CLI

python -m app.main preflight
python -m app.main defend-scan
python -m app.main attack-sim
python -m app.main report
python -m app.main cleanup

PowerShell wrappers

pwsh ./scripts/setup-win11.ps1
pwsh ./scripts/start-lab.ps1
pwsh ./scripts/run-attack-sim.ps1
pwsh ./scripts/run-defend-scan.ps1
pwsh ./scripts/generate-report.ps1
pwsh ./scripts/cleanup.ps1

Example Console Output

============================================================
CVE-2025-1974 Windows 11 Attack + Defense Lab
============================================================
[PRECHECK] Windows 11 assumptions .............. PASS
[PRECHECK] Docker Desktop ...................... PASS
[PRECHECK] kubectl ............................. PASS
[PRECHECK] kind ................................ PASS
[PRECHECK] Python 3.11 ......................... PASS

[SCAN] Cluster name: cve-2025-1974-lab
[SCAN] ingress-nginx detected .................. YES
[SCAN] Controller version ...................... 1.11.4
[SCAN] Validating Admission Controller ......... ENABLED
[SCAN] Version assessment ...................... AFFECTED
[SCAN] Risk summary ............................ Upgrade to 1.11.5+ or 1.12.1+ and disable admission until upgraded.

[SIM] ATTACK_PATH_IDENTIFIED
[SIM] VALIDATION_PATH_REACHED
[SIM] DEFENSE_MISSING
[SIM] SIMULATED_RISK_CONFIRMED

[REPORT] Markdown report written to reports/latest-report.md

Attack Flow Demo

The attack-emulation flow is intentionally non-weaponized:

1. The lab fingerprints the local disposable cluster and checks whether ingress-nginx appears present.
2. The simulator explains that the risk path conceptually involves the Validating Admission Controller.
3. A sanitized fixture is replayed only to a local simulator, which emits stage markers such as ATTACK_PATH_IDENTIFIED and SIMULATED_RISK_CONFIRMED.
4. When mitigation is active in the lab state, the simulator emits MITIGATION_PRESENT, ATTACK_PATH_BLOCKED, and UPGRADE_REQUIRED instead.
5. The run saves logs and summary artifacts under reports/.

Defense Flow

The defense-validation flow is allowed to perform real local checks:

1. Verify Windows 11 prerequisites.
2. Create or inspect a local-only kind cluster named cve-2025-1974-lab.
3. Detect whether ingress-nginx is present and attempt to infer the version from deployment images.
4. Assess whether the version appears affected or fixed according to official guidance.
5. Determine whether the Validating Admission Controller appears enabled.
6. Produce a concise risk summary and lab-specific analytics for simulator activity.

Cleanup

pwsh ./scripts/cleanup.ps1

This removes the disposable kind cluster if present and clears generated report artifacts while preserving repository structure.

Limitations

• The attack track is a simulator, not a real exploit.
• The project does not test public, shared, or non-local systems.
• Real cluster assessment is limited by the visibility provided by kubectl and local cluster state.
• If image tags or admission configuration are hidden or custom, findings may be uncertain.
• Lab detections are synthetic and must not be treated as authoritative real-world IOCs.
• The official Kubernetes issue states there are no known authoritative indicators of compromise.

References

• Official Kubernetes advisory
• Official Kubernetes issue
• Original public PoC reference

Credits

This project conceptually references the public repository zulloper/CVE-2025-1974 by GitHub user @zulloper for historical/contextual study only. No offensive code has been copied into this repository.

Acknowledgements to Nir Ohfeld, Ronen Shustin, Sagi Tzadik, and Hillai Ben-Sasson from Wiz for responsibly disclosing the vulnerabilities, as recognized in official Kubernetes materials.

This repository is an independent clean-room educational lab for Windows 11 and is not affiliated with or endorsed by @zulloper, Wiz, Kubernetes, or the ingress-nginx maintainers.