CVE-2025-24514 Scanner

Ingress-Nginx Controller is a widely used software in the Kubernetes ecosystem, allowing users to manage and distribute incoming network traffic. Typically deployed by DevOps professionals and cloud architects, its main purpose is enabling ingress rules for applications hosted within Kubernetes clusters. It is popular for providing a seamless integration with various services, aiding the deployment of diverse, scalable, and robust applications. Industries such as tech, finance, and e-commerce rely on it extensively to handle their cloud infrastructure. The high configurability and versatility of the controller make it a go-to choice for large-scale cloud environments. Its significant community support further solidifies its role in modern application deployment pipelines.

The Code Injection vulnerability pertains to a security flaw where untrusted input is injected as code into a program without adequate validation or sanitization. In the context of Ingress-Nginx, an attacker leverages this by manipulating the `auth-url` annotation to execute unauthorized code on the server. This vulnerability permits arbitrary code execution within the context of the host, thereby compromising the entire Kubernetes node. The root cause lies in insufficient input validation when processing annotation values, allowing crafted payloads to bypass security measures.

Specifically, the vulnerable endpoint is the Ingress-Nginx Controller's annotation parser, which processes the `auth-url` annotation. An attacker can inject malicious code into this annotation, which is then executed by the controller's Lua scripts. The parameter `auth-url` is not properly sanitized, enabling injection of shell commands or Lua code. This can be exploited by sending a specially crafted ingress resource definition to the Kubernetes API server, triggering the vulnerability during the controller's reconciliation loop.

If exploited, an attacker can achieve remote code execution on the host running the Ingress-Nginx Controller. This could lead to full cluster compromise, data exfiltration, lateral movement to other services, and disruption of critical applications. The high CVSS score of 8.8 reflects the severe impact on confidentiality, integrity, and availability. Organizations using Ingress-Nginx Controller in production environments face significant risk, especially those handling sensitive data in finance, healthcare, or e-commerce sectors.