¡¾Îó²îͨ¸æ¡¿Kubernetes Ingress-nginxÐÅϢй¶Îó²î£¨CVE-2021-25746£©

Ðû²¼Ê±¼ä 2022-04-25


0x00 Îó²î¸ÅÊö

CVE   ID

CVE-2021-25746

·¢Ã÷ʱ¼ä

2022-04-22

Àà      ÐÍ

ÐÅϢй¶

µÈ      ¼¶

¸ßΣ

Ô¶³ÌʹÓÃ

ÊÇ

Ó°Ïì¹æÄ£


¹¥»÷ÖØÆ¯ºó

µÍ

Óû§½»»¥

ÎÞ

PoC/EXP


ÔÚҰʹÓÃ


 

0x01 Îó²îÏêÇé

Ingress-nginx ÊÇ Kubernetes µÄÈë¿Ú¿ØÖÆÆ÷£¬£¬£¬£¬£¬Ê¹ÓÃNGINX×÷Ϊ·´ÏòÊðÀíºÍ¸ºÔØÆ½ºâÆ÷¡£¡£¡£

4ÔÂ22ÈÕ£¬£¬£¬£¬£¬Kubernetes¹ûÕæÁËingress-nginxÖеÄÒ»¸öÐÅϢй¶Îó²î£¨CVE-2021-25746£©£¬£¬£¬£¬£¬ÆäCVSSÆÀ·ÖΪ7.6¡£¡£¡£

Ingress-nginx v1.2.0֮ǰµÄ°æ±¾Öб£´æÇå¾²ÎÊÌ⣬£¬£¬£¬£¬¿ÉÒÔ½¨Éè»ò¸üÐÂingress¹¤¾ßµÄÓû§¿ÉÒÔʹÓøÃÎó²î»ñÈ¡ingress-nginx¿ØÖÆÆ÷µÄƾ֤¡£¡£¡£ÔÚĬÈÏÉèÖÃÖУ¬£¬£¬£¬£¬¸Ãƾ֤¿ÉÒÔ»á¼û¼¯ÈºÖеÄÐÅÏ¢¡£¡£¡£

 

Ó°Ïì¹æÄ£

Kubernetes Ingress-nginx < v1.2.0

×¢£ºÈôÊǼ¯ÈºÉÏûÓÐ×°Öà ingress-nginx£¬£¬£¬£¬£¬Ôò²»»áÊܵ½Ó°Ï죬£¬£¬£¬£¬¿Éͨ¹ýÔËÐÐkubectl get po -n ingress-nginxÀ´¼ì²é¡£¡£¡£


0x02 Çå¾²½¨Òé

ÏÖÔÚ´ËÎó²îÒѾ­ÐÞ¸´£¬£¬£¬£¬£¬¿É¸üе½Kubernetes Ingress-nginx v1.2.0-beta.0¡¢v1.2.0»ò¸ü¸ß°æ±¾¡£¡£¡£

ÏÂÔØÁ´½Ó£º

https://github.com/kubernetes/ingress-nginx/tags

 

0x03 ²Î¿¼Á´½Ó

https://github.com/kubernetes/ingress-nginx/issues/8503

https://github.com/kubernetes/ingress-nginx

https://www.openwall.com/lists/oss-security/2022/04/22/6

 

0x04 °æ±¾ÐÅÏ¢

°æ±¾

ÈÕÆÚ

ÐÞ¸ÄÄÚÈÝ

V1.0

2022-04-25

Ê×´ÎÐû²¼

 

0x05 ¸½Â¼

¼øºÚµ£±£Íø¼ò½é

¼øºÚµ£±£Íø¹«Ë¾½¨ÉèÓÚ1996Ä꣬£¬£¬£¬£¬²¢ÓÚ2010Äê6ÔÂ23ÈÕÔÚÉî½»ËùÖÐС°åÕýʽ¹ÒÅÆÉÏÊУ¬£¬£¬£¬£¬ÊǺ£ÄÚ¼«¾ßʵÁ¦µÄ¡¢ÓµÓÐÍêÈ«×ÔÖ÷֪ʶ²úȨµÄÍøÂçÇå¾²²úÆ·¡¢¿ÉÐÅÇå¾²ÖÎÀíÆ½Ì¨¡¢Ç徲ЧÀÍÓë½â¾ö¼Æ»®µÄ×ÛºÏÌṩÉÌ¡£¡£¡£

¹«Ë¾×ܲ¿Î»ÓÚ±±¾©ÊÐÖйشåÈí¼þÔ°£¬£¬£¬£¬£¬ÔÚÌìϸ÷Ê¡¡¢ÊС¢×ÔÖÎÇøÉèÓзÖÖ§»ú¹¹£¬£¬£¬£¬£¬ÓµÓÐÁýÕÖÌìϵÄÇþµÀϵͳºÍÊÖÒÕÖ§³ÖÖÐÐÄ£¬£¬£¬£¬£¬²¢ÔÚ±±¾©¡¢ÉϺ£¡¢³É¶¼¡¢¹ãÖÝ¡¢³¤É³¡¢º¼ÖÝµÈ¶àµØÉèÓÐÑз¢ÖÐÐÄ¡£¡£¡£

¶àÄêÀ´£¬£¬£¬£¬£¬¼øºÚµ£±£ÍøÖÂÁ¦ÓÚÌṩ¾ßÓйú¼Ê¾ºÕùÁ¦µÄ×ÔÖ÷Á¢ÒìµÄÇå¾²²úÆ·ºÍ×î¼Ñʵ¼ùЧÀÍ£¬£¬£¬£¬£¬×ÊÖú¿Í»§ÖÜÈ«ÌáÉýÆäIT»ù´¡ÉèÊ©µÄÇå¾²ÐÔºÍÉú²úЧÄÜ£¬£¬£¬£¬£¬Îª´òÔìºÍÌáÉý¹ú¼Ê»¯µÄÃñ×åÐÅÏ¢Çå¾²¹¤ÒµÁì¾üÆ·ÅÆ¶ø²»Ð¸Æð¾¢¡£¡£¡£


¹ØÓÚ¼øºÚµ£±£Íø

¼øºÚµ£±£ÍøÇå¾²Ó¦¼±ÏìÓ¦ÖÐÐÄÖ÷ÒªÕë¶ÔÖ÷ÒªÇå¾²Îó²îµÄÔ¤¾¯¡¢¸ú×ٺͷÖÏíÈ«Çò×îеÄÍþвÇ鱨ºÍÇå¾²±¨¸æ¡£¡£¡£

¹Ø×¢ÒÔϹ«Öںţ¬£¬£¬£¬£¬»ñȡȫÇò×îÐÂÇå¾²×ÊѶ£º

image.png