Docs

Volcengine Kubernetes Engine

Security announcements

Ingress-nginx add-on security vulnerability advisory (CVE-2024-7646)

Vulnerability background

The Kubernetes community has disclosed the ingress-nginx security vulnerability CVE-2024-7646. ingress-nginx is the Ingress controller for Kubernetes and uses nginx as a reverse proxy and load balancer. Users with permission to create Ingress objects (in the networking.k8s.io or extensions API group) can bypass annotation validation and inject malicious configuration into the nginx configuration file. Attackers can exploit this vulnerability to obtain the credentials for the ingress-nginx controller. In the default configuration, this credential can access all secrets in the cluster.

Vulnerability level

The CVE-2024-7646 vulnerability has been assessed as a high-risk vulnerability, with a CVSS score of 8.8

Scope of impact

v1.11.0 <= Ingress-nginx-controller < v1.11.2

Ingress-nginx-controller < v1.10.4

Preventive measures

VKE has released a version of ingress-nginx-controller that addresses this vulnerability. For details, see the ingress-nginx release notes. Before upgrading the ingress-nginx add-on, please carefully review the impact of the changes to avoid affecting your business traffic. Version v1.10.4-vke.1 was released for ingress-nginx installed via the App Market to fix this vulnerability. Without upgrading the ingress-nginx add-on, you can mitigate this vulnerability by the following methods:

In the ConfigMap of the ingress-nginx add-on, set .data.annotation-value-word-blocklist to "load_module,lua_package,_by_lua,location,root,proxy_pass,serviceaccount,{,},',\"". Detect and block the values of Ingress object annotations based on keywords.

Install admission control add-ons (for example, Kyverno and Gatekeeper) in the cluster to validate the creation of Ingress objects and block vulnerability exploitation.

Restrict permission to create ingress so that only trusted users are authorized.

tip

The community fixed this vulnerability in ingress-nginx-controller versions v1.10.4 and v1.11.2. The fixed versions only support Kubernetes version 1.26 and above. If the Kubernetes version of the VKE cluster is lower than 1.26, please upgrade the cluster first.