NGINX Ingress annotation snippets contains LUA code execution misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_K8S_152
Category - Subcategory	Kubernetes - Native Security Controls
Provider	OTHER
Severity	LOW
Framework	Helm, Kubernetes, Kustomize

Impact

Allowing custom snippet annotations in ingress-nginx enables a user, who can create or update ingress objects, to obtain all secrets in the cluster. To still allow users leveraging the snippet feature it is recommend to remove any usage of LUA code. Learn more around https://nvd.nist.gov/vuln/detail/CVE-2021-25742[CVE-2021-25742]

How to Fix

[source,go]

{ "apiVersion: networking.k8s.io/v1 kind: Ingress metadata: name: app-ingress annotations: nginx.ingress.kubernetes.io/server-snippet: |

• lua_package_path "/etc/nginx/lua/?.lua;;"; location / { return 200 'OK'; }

kubernetes.io/ingress.class: "nginx" spec: rules:

• http: paths:
• path: /exp pathType: Prefix backend: service: name: some-service port: number: 1234", }

---