CVE-2023-5044: Ingress-nginx code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation

October 25, 2023 (updated February 13, 2025)

A security issue was identified in ingress-nginx where the nginx.ingress.kubernetes.io/permanent-redirect annotation on an Ingress object (in the networking.k8s.io or extensions API group) can be used to inject arbitrary commands, and obtain the credentials of the ingress-nginx controller. In the default configuration, that credential has access to all secrets in the cluster.

References

github.com/advisories/GHSA-fp9f-44c2-cw27
github.com/kubernetes/ingress-nginx
github.com/kubernetes/ingress-nginx/issues/10572
groups.google.com/g/kubernetes-security-announce/c/ukuYYvRNel0
nvd.nist.gov/vuln/detail/CVE-2023-5044
security.netapp.com/advisory/ntap-20240307-0012

Code Behaviors & Features

Detect and mitigate CVE-2023-5044 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →