CVE-2025-1974 PoC — Kubernetes ingress-nginx 安全漏洞

Source

https://github.com/tuladhar/ingress-nightmare

Associated Vulnerability

Title:Kubernetes ingress-nginx 安全漏洞 (CVE-2025-1974)
Description:Kubernetes ingress-nginx是云原生计算基金会（Cloud Native Computing Foundation）开源的Kubernetes 的入口控制器，使用NGINX作为反向代理和负载均衡器。 Kubernetes ingress-nginx存在安全漏洞，该漏洞源于在某些条件下，未认证的攻击者可通过访问pod网络在ingress-nginx控制器环境中执行任意代码，可能导致Secrets泄露。

Description

IngressNightmare (CVE-2025-1974)

Readme

# IngressNightmare (CVE-2025-1974)

This Python script can help you understand if you're running the Ingress NGINX Controller, and if yes if it's using a known vulnerable version.

## Usage

First, make sure to install `uv` [from here](https://docs.astral.sh/uv/#installation) and then run the script against the Kubernetes cluster to audit.

```
uv run --with kubernetes,packaging check.py
```

## Sample outputs

### Vulnerable cluster:

```
Checking for ingress-nginx pods...
ℹ️ It looks like you're using the NGinx ingress controller.

Checking service 'ingress-nginx-controller-admission' in namespace 'ingress-nginx'...
ℹ️ Found related service 'ingress-nginx-controller-admission' of type: ClusterIP
  → ClusterIP: 10.100.127.164

📦 Images used by ingress-nginx controller pods:
  - registry.k8s.io/ingress-nginx/controller:v1.12.0@sha256:e6b8de175acda6ca913891f0f727bca4527e797d52688cbe9fec9040d6f6b6fa

🔢 Detected ingress-nginx controller versions:
  → 1.12.0   🛑 LIKELY VULNERABLE
```

### Cluster running a non-vulnerable version:

```
Checking for ingress-nginx pods...
ℹ️ It looks like you're using the NGinx ingress controller.

Checking service 'ingress-nginx-controller-admission' in namespace 'ingress-nginx'...
ℹ️ Found related service 'ingress-nginx-controller-admission' of type: ClusterIP
  → ClusterIP: 10.96.74.187

📦 Images used by ingress-nginx controller pods:
  - registry.k8s.io/ingress-nginx/controller:v1.12.1@sha256:d2fbc4ec70d8aa2050dd91a91506e998765e86c96f32cffb56c503c9c34eed5b

🔢 Detected ingress-nginx controller versions:
  → 1.12.1   ✅ Likely safe
```

## Credit
- https://github.com/DataDog/security-labs-pocs/tree/main/validation-scripts/cve-2025-1974-ingress-nightmare

File Snapshot


 [4.0K]  /data/pocs/04f2a9f4862ee9fb2184955d8bdf1e8f540d2171
├── [3.6K]  check.py
├── [1.0K]  LICENSE
└── [1.7K]  README.md

0 directories, 3 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!