ingress-nginx Configuration Injection Vulnerability via Rewrite-Target Annotation

A vulnerability exists in ingress-nginx versions prior to 1.13.8, 1.14.4, and 1.15.0, allowing the `nginx.ingress.kubernetes.io/rewrite-target` annotation to inject arbitrary configuration into nginx. This injection could lead to arbitrary code execution within the ingress-nginx controller and the unauthorized disclosure of Secrets accessible to the controller, which by default can access all cluster-wide Secrets.

Impact

Exploitation of this vulnerability could result in arbitrary code execution in the context of the ingress-nginx controller and the disclosure of cluster-wide Secrets accessible to the controller.

Remediation

Users can upgrade to ingress-nginx versions 1.13.8, 1.14.4, or 1.15.0. For instructions on upgrading, refer to the 'Upgrading Ingress-nginx' documentation. Ingress-nginx users can also use admission control to block the use of the rewrite-target annotation as a temporary mitigation.