NGINX Ingress has annotation snippets misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_K8S_153
Category - Subcategory	Kubernetes - Native Security Controls
Provider	OTHER
Severity	LOW
Framework	Helm, Kubernetes, Kustomize

Impact

Allowing custom snippet annotations in ingress-nginx enables a user, who can create or update ingress objects, to obtain all secrets in the cluster. The safest way is to disallow any usage of annotation snippets. Learn more around https://nvd.nist.gov/vuln/detail/CVE-2021-25742[CVE-2021-25742]

How to Fix

[source,go]

{ "apiVersion: networking.k8s.io/v1 kind: Ingress metadata: name: app-ingress annotations:

• nginx.ingress.kubernetes.io/server-snippet: |

• location / {

• return 200 'OK';

• } kubernetes.io/ingress.class: "nginx" spec: rules:

• http: paths:

• path: /exp pathType: Prefix backend: service: name: some-service port: number: 1234", }

---