Security Bulletin: IBM Cloud Kubernetes Service is affected by Kubernetes Ingress Controller security vulnerabilities (CVE-2023-5043, CVE-2023-5044, CVE-2022-4886)

Security Bulletin

Summary

IBM Cloud Kubernetes Service is affected by Kubernetes Ingress Controller security vulnerabilities where a user that can create or update Ingress objects can use the `nginx.ingress.kubernetes.io/configuration-snippet` annotation (CVE-2023-5043) or the `nginx.ingress.kubernetes.io/permanent-redirect` annotation (CVE-2023-5044) to inject arbitrary commands, or can use directives to bypass the sanitization of the `spec.rules[].http.paths[].path field` (CVE-2022-4886) to obtain the credentials of the Kubernetes Ingress Controller (ALB). In the default configuration, that credential has access to all secrets in the cluster.

These vulnerabilities are relevant mainly in multi-tenant environments where non-admin users have permissions to create Ingress objects.

Vulnerability Details

CVEID: CVE-2022-4886
Description: Ingress-nginx path sanitization can be bypassed with log_format directive.
CVSS Base Score: 8.8
CVSS Temporal Score: https://exchange.xforce.ibmcloud.com/vulnerabilities/269570 for more information
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

CVEID: CVE-2023-5043
Description: Kubernetes ingress-nginx could allow a remote authenticated attacker to execute arbitrary commands on the system, caused by improper input validation by the
http://nginx.ingress.kubernetes.io/configuration-snippet|nginx.ingress.kubernetes.io/configuration-snippet annotation injection. By sending a specially crafted request, an attacker could exploit this vulnerability to execute arbitrary commands on the system.
CVSS Base Score: 7.6
CVSS Temporal Score: https://exchange.xforce.ibmcloud.com/vulnerabilities/269574 for more information
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L)

CVEID: CVE-2023-5044
Description: Kubernetes ingress-nginx could allow a remote authenticated attacker to execute arbitrary commands on the system, caused by improper input validation by the
http://nginx.ingress.kubernetes.io/permanent-redirect|nginx.ingress.kubernetes.io/permanent-redirect annotation. By sending a specially crafted request, an attacker could exploit this vulnerability to execute arbitrary commands on the system.
CVSS Base Score: 7.6
CVSS Temporal Score: https://exchange.xforce.ibmcloud.com/vulnerabilities/269578 for more information
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L)

Affected Products and Versions

IBM Cloud Kubernetes Service clusters with Kubernetes Ingress Controllers (ALBs - application load balancers) with versions below

<1.9.4_5698_iks are impacted by CVE-2023-5043 and CVE-2023-5044
<1.8.1_5317_iks are additionally impacted by CVE-2022-4886

Remediation/Fixes

New Kubernetes Ingress Controller (ALB) version 1.9.4_5698_iks contains fixes for these vulnerabilities and is available immediately for early adopters. The fixed version will be automatically applied to all clusters once it has passed all GA validation and is marked as the default version for ALBs.

The new version provides annotation validation feature which allows clusters administrators to enforce restrictions on the contents of annotation fields for additional security. This feature will be enabled by default for Kubernetes Ingress Controller (ALB) versions 1.9.4_5698_iks and later.

Action Required (before version 1.9.4_5698_iks or later is marked as default)

To update your ALBs before the automatic update period for this version you will need to disable automatic updates and apply Kubernetes Ingress Controllers (ALBs) version 1.9.4_5698_iks manually.

Review the annotations on your Ingress resources and make sure that the configuration values are valid.
To prevent the downgrading your ALBs to the current default version, use the following IBM Cloud CLI command to disable automatic updates:
```
ibmcloud ks ingress alb autoupdate disable
```
When automatic updates for the Ingress ALBs are disabled, you can force a one-time update of your ALBs with the following command:
```
ibmcloud ks ingress alb update --version 1.9.4_5698_iks
```
After you force a one-time update, automatic updates will need to remain disabled until version 1.9.4_5698_iks or later is marked as the default version.

Action Required (after version 1.9.4_5698_iks or later is marked as default)

Verify your IBM Cloud Kubernetes Service clusters with Kubernetes Ingress application load balancers (ALBs) are no longer exposed to these vulnerabilities, use the following IBM Cloud CLI command to list all Ingress ALB IDs in a cluster to confirm the version:
```
ibmcloud ks ingress alb ls
```
If the versions are at version 1.9.4_5698_iks or later, they are no longer exposed.
Use the following IBM Cloud CLI command to confirm current the configuration of autoupdates:
ibmcloud ks ingress alb autoupdate get
If autoupdates are disabled, use the following IBM Cloud CLI command to re-enable the automatic updates by IBM when a new default image version is made available:
```
ibmcloud ks ingress alb autoupdate enable
```

Get Notified about Future Security Bulletins

Subscribe to My Notifications to be notified of important product support alerts like this.

References

Complete CVSS v3 Guide
On-line Calculator v3

Off

IBM Cloud Docs - Customizing ALB routing

Ingress-Nginx Controller - Annotations

Kubernetes Advisories

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

Disclaimer

According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES ""AS IS"" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY. In addition to other efforts to address potential vulnerabilities, IBM periodically updates the record of components contained in our product offerings. As part of that effort, if IBM identifies previously unidentified packages in a product/service inventory, we address relevant vulnerabilities regardless of CVE date. Inclusion of an older CVEID does not demonstrate that the referenced product has been used by IBM since that date, nor that IBM was aware of a vulnerability as of that date. We are making clients aware of relevant vulnerabilities as we become aware of them. "Affected Products and Versions" referenced in IBM Security Bulletins are intended to be only products and versions that are supported by IBM and have not passed their end-of-support or warranty date. Thus, failure to reference unsupported or extended-support products and versions in this Security Bulletin does not constitute a determination by IBM that they are unaffected by the vulnerability. Reference to one or more unsupported versions in this Security Bulletin shall not create an obligation for IBM to provide fixes for any unsupported or extended-support products or versions.

Document Location

Worldwide

[{"Type":"MASTER","Line of Business":{"code":"LOB21","label":"Public Cloud Platform"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSJTBP","label":"IBM Cloud Kubernetes Service and Red Hat OpenShift on IBM Cloud"},"ARM Category":[],"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions"}]

Tips

Security Bulletin: IBM Cloud Kubernetes Service is affected by Kubernetes Ingress Controller security vulnerabilities (CVE-2023-5043, CVE-2023-5044, CVE-2022-4886)