cve-2025-24514

🔥 CVE-2025-24514 Remote Vulnerability Check PoC This script is a Python-based PoC that can remotely check for the CVE-2025-24514 vulnerability NGINX configuration manipulation and potential RCE through auth-url injection in ingress-nginx. 🧠 Vulnerability Overview CVE-2025-24514 is a vulnerability...

ingressNightmare-CVE-2025-1974-exps

Ingress Nightmare CVE-2025-1907 Description This vulnerability allows remote attackers to execute arbitrary code on affected installations of kubernetes/ingress-nginx. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of HTTP requests. It i...

ingress-nightmare

IngressNightmare CVE-2025-1974 This Python script can help you understand if you're running the Ingress NGINX Controller, and if yes if it's using a known vulnerable version. Usage First, make sure to install uv from here and then run the script against the Kubernetes cluster to audit...

CVE-2025-1974-PoC-exploit

CVE-2025-1974-PoC-exploit Kubernetes Ingress-nginx RCE IngressNightmare root@kitploit: ❯ python3 exploit.py http://localhost:8443 "id" ============================================================ CVE-2025-1974 - IngressNightmare Exploit ============================================================...

CVE-2025-1974

Kubernetes Ingress-NGINX Ejecución remota de código no autenticada CVE-2025-1974 Ingress-NGINX: Controlador de ingreso para Kubernetes que utiliza NGINX como proxy inverso y balanceador de carga La vulnerabilidad "IngressNightmare" CVE-2025-1974 se origina en un defecto crítico en el Admission...

IngressNightmare-PoC

Exploit para Ingress NGINX - IngressNightmare Este proyecto proporciona un exploit dirigido a vulnerabilidades críticas de Ejecución Remota de Código RCE no autenticada en el Controlador Ingress NGINX para Kubernetes, conocidas colectivamente como IngressNightmare. Investigación de Wiz En la...

Ingress-Nginx Controller - Configuration Injection via Unsanitized `auth-tls-match-cn` Annotation

A security issue was discovered in ingress-nginx https-//github.com/kubernetes/ingress-nginx where the auth-tls-match-cn Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of...

Ingress-Nginx Controller - Configuration Injection via Unsanitized `auth-url` Annotation

A security issue was discovered in ingress-nginx https-//github.com/kubernetes/ingress-nginx where the auth-url Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets...

ingress-nginx-0.21-1.19.5

COMPILACIÖN: root@kitploit: cd ./ingress-nginx-0.21-1.19.5 cd images/nginx/ make cd - cd images/e2e/ make docker-build cd - e2etag=docker images|grep e2e|awk 'print $2' sed -i "s/e2e:v12232020-dce860a/e2e:$e2etag/" build/go-in-docker.sh make echo -e '\n\n\n\n\n' docker images|grep ingress-nginx...

CVE-2025-1974-poc

POC of IngressNightmare, RCE in Ingress NGINX CVE-2025-1974 Developed from: https://github.com/zwxxb/CVE-2025-1974/blob/main/poc.py https://www.wiz.io/blog/ingress-nginx-kubernetes-vulnerabilitieshow-did-we-discover-ingressnightmare-24 Thanks 使用说明 root@kitploit: forward the admission webhook...

CVE-2025-1974

CVE-2025-1974 — IngressNightmare ingress-nginx Introducción Este documento presenta la investigación de la vulnerabilidad CVE-2025-1974 , que afecta al componente ingress-nginx validating admission controller para Kubernetes. CVE-2025-1974 es una vulnerabilidad crítica CVSS 3.1 9.8, que consiste ...

Ingress-Nginx Controller - Configuration Injection via Unsanitized Mirror Annotations

A security issue was discovered in ingress-nginx https-//github.com/kubernetes/ingress-nginx where the mirror-target and mirror-host Ingress annotations can be used to inject arbitrary configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx...

cve-2024-7646

CVE-2024-7646 Descripción Por defecto, nginx.ingress.kubernetes.io/server-snippet está deshabilitado, pero debido a este CVE, nginx.ingress.kubernetes.io/auth-tls-verify-client puede aún insertar fragmentos personalizados, o incluso se puede incluir código lua. Versión corregida controlador...

ingressnightmare-detection-poc

IngressNightmare Detection Tool Overview This tool provides a non-intrusive detection capability for the IngressNightmare vulnerability chain CVE-2025-1974 affecting Ingress NGINX Controller. It specifically leverages the auth-url annotation injection vector CVE-2025-24514 to verify the presence ...

CVE-2025-1974

LÉEME Hablar es barato, solo mira el código. Se pueden encontrar detalles en https://www.wiz.io/blog/ingress-nginx-kubernetes-vulnerabilities Uso 1. Cambia la ip en shell.c 2. Verifica que docker esté disponible y ejecuta make shell.so. Necesitamos compilar el .so en Alpine para asegurarnos de qu...

CVE-2025-1974

CVE-2025-1974 WhiteHat School 3.ª promoción - 김소은 @salt318 https://github.com/salt318/vulhub Resumen Se produce debido a una falla en el Ingress-NGINX Admission Controller, un mecanismo de seguridad fundamental de Kubernetes El Ingress-NGINX Admission Controller queda expuesto a la red sin...

CVE-2025-1974

CVE-2025-1974: Análisis de vulnerabilidad y configuración del entorno PoC para Kubernetes Ingress Nginx Controller Entorno de prueba MacOS M2 Ingress NGINX Controller 1.11.3 Rancher Desktop Docker Minikube Kubernetes Configuración del entorno de prueba local M2 MacOS Instalar minikube para las...

cve-2023-5044

CVE-2023-5044 Ingress Nginx 利用概念验证 这是一个快速利用 Ingress Nginx 控制器中最近 CVE 漏洞的 Go 程序。 关于如何利用此漏洞的详细信息已通过 Rory McCune 的博客发布在 https://raesene.github.io/blog/2023/10/29/exploiting-CVE-2023-5044/，此工具只是将过程自动化了一点，并整理了利用程序，使其成为一个更灵活、通用的远程代码执行负载。 安装 root@kitploit: % go install...

POC-IngressNightmare-CVE-2025-1974

POC de IngressNightmare CVE-2025-1974 Desarrollado a partir de: https://github.com/yoshino-s/CVE-2025-1974 https://www.wiz.io/blog/ingress-nginx-kubernetes-vulnerabilities Hablar es barato, solo mira el código. Los detalles se pueden encontrar en...

IngressNightmare-RCE-POC

⚠️ RCE Crítica en Ingress-NGINX mediante Inyección de Configuración CVE-2025-1974 y más Este repositorio contiene un exploit de prueba de concepto PoC para CVE-2025-1974 , una vulnerabilidad Crítica CVSS 9.8 en el controlador Ingress-NGINX para Kubernetes. Esta falla permite la ejecución remota de...