# MA-978.112023: MyCERT Advisory - Multiple Vulnerabilities in Kubernetes Ingress Controller

**Date:** 02 Nov 2023  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-978.112023  
**Advisory ID:** MA-978.112023

---

**1.0 Introduction**
Recently, MyCERT has observed multiple vulnerabilities in Kubernetes Ingress Controller which could be exploited to steal credentials.
**2.0 Impact**
Three new security flaws discovered in the NGINX Ingress Controller for Kubernetes. These flaws are CVE-2022-4886, CVE-2023-5043, and CVE-2023-5044.
1. CVE-2022-4886(CVSS score: 8.8)- is a vulnerability in the way the path field is used in the Ingress routing definitions.
- An attacker who can control the Ingress object can exploit this vulnerability to steal Kubernetes API credentials from the ingress controller.
2. CVE-2023-5043 (CVSS score: 7.6) and CVE-2023-5044 (CVSS score: 7.6) are vulnerabilities in the way the configuration-snippet and permanent-redirect annotations are handled by the ingress controller.
- An attacker who can control the configuration of the Ingress object can exploit these vulnerabilities to inject arbitrary code into the ingress controller process and get access to everything this process has access to including secret credentials.
**3.0 Affected Products**
Kubernetes Ingress Controller versions <v1.9.0
**4.0 Recommendations**
MyCERT recommends the following mitigations to prevent these vulnerabilities to be exploited:
- Enable strict path type validation in Ingress objects to prevent attackers from creating Ingress objects with invalid paths. (CVE-2022-4886)
- Ingress Administrators should set the --enable-annotation-validation flag to enforce restrictions on the contents of ingress-nginx annotation fields. (CVE-2023-5043 and CVE-2023-5044)
Kindly refer to the following for more information:
- <https://github.com/kubernetes/ingress-nginx/issues/10571>
- <https://github.com/kubernetes/ingress-nginx/issues/10572>
- <https://github.com/kubernetes/ingress-nginx/issues/10570>
Generally, MyCERT advises the users of this devices to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail: cyber999[at]cybersecurity.my 
Phone: 1-300-88-2999 (monitored during business hours) 
Mobile: +60 19 2665850 (24x7 call incident reporting) 
Business Hours: Mon - Fri 09:00 -18:00 MYT 
Web: <https://www.mycert.org.my> 
Twitter: <https://twitter.com/mycert> 
Facebook: <https://www.facebook.com/mycert.org.my>
**5.0    References**
- [3 new NGINX ingress controller Kubernetes 
- <https://github.com/kubernetes/ingress-nginx/issues/10571>
- <https://github.com/kubernetes/ingress-nginx/issues/10572>
- <https://github.com/kubernetes/ingress-nginx/issues/10570>