Security Bulletin: IBM Cloud Kubernetes Service is affected by Kubernetes Ingress Controller security vulnerabilities (CVE-2023-5043, CVE-2023-5044, CVE-2022-4886)

Summary

IBM Cloud Kubernetes Service is affected by Kubernetes Ingress Controller security vulnerabilities where a user that can create or update Ingress objects can use the nginx.ingress.kubernetes.io/configuration-snippet annotation (CVE-2023-5043) or the nginx.ingress.kubernetes.io/permanent-redirect annotation (CVE-2023-5044) to inject arbitrary commands, or can use directives to bypass the sanitization of the spec.rules[].http.paths[].path field (CVE-2022-4886) to obtain the credentials of the Kubernetes Ingress Controller (ALB). In the default configuration, that credential has access to all secrets in the cluster.

These vulnerabilities are relevant mainly in multi-tenant environments where non-admin users have permissions to create Ingress objects.

Vulnerability Details

CVEID: CVE-2022-4886
Description: Ingress-nginx path sanitization can be bypassed with log_format directive.
CVSS Base Score: 8.8
CVSS Temporal Score: <https://exchange.xforce.ibmcloud.com/vulnerabilities/269570&gt; for more information
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

CVEID: CVE-2023-5043
Description: Kubernetes ingress-nginx could allow a remote authenticated attacker to execute arbitrary commands on the system, caused by improper input validation by the
http://nginx.ingress.kubernetes.io/configuration-snippet|nginx.ingress.kubernetes.io/configuration-snippet annotation injection. By sending a specially crafted request, an attacker could exploit this vulnerability to execute arbitrary commands on the system.
CVSS Base Score: 7.6
CVSS Temporal Score: <https://exchange.xforce.ibmcloud.com/vulnerabilities/269574&gt; for more information
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L)

CVEID: CVE-2023-5044
Description: Kubernetes ingress-nginx could allow a remote authenticated attacker to execute arbitrary commands on the system, caused by improper input validation by the
http://nginx.ingress.kubernetes.io/permanent-redirect|nginx.ingress.kubernetes.io/permanent-redirect annotation. By sending a specially crafted request, an attacker could exploit this vulnerability to execute arbitrary commands on the system.
CVSS Base Score: 7.6
CVSS Temporal Score: <https://exchange.xforce.ibmcloud.com/vulnerabilities/269578&gt; for more information
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L)

Affected Products and Versions

IBM Cloud Kubernetes Service clusters with Kubernetes Ingress Controllers (ALBs - application load balancers) with versions below

• <1.9.4_5698_iks are impacted by CVE-2023-5043 and CVE-2023-5044
• <1.8.1_5317_iks are additionally impacted by CVE-2022-4886

Remediation/Fixes

New Kubernetes Ingress Controller (ALB) version 1.9.4_5698_iks contains fixes for these vulnerabilities and is available immediately for early adopters. The fixed version will be automatically applied to all clusters once it has passed all GA validation and is marked as the default version for ALBs.

The new version provides annotation validation feature which allows clusters administrators to enforce restrictions on the contents of annotation fields for additional security. This feature will be enabled by default for Kubernetes Ingress Controller (ALB) versions 1.9.4_5698_iks and later.

Action Required (before version 1.9.4_5698_iks or later is marked as default)

To update your ALBs before the automatic update period for this version you will need to disable automatic updates and apply Kubernetes Ingress Controllers (ALBs) version 1.9.4_5698_iks manually.

1. Review the annotations on your Ingress resources and make sure that the configuration values are valid.

2. To prevent the downgrading your ALBs to the current default version, use the following IBM Cloud CLI command to disable automatic updates:

   ibmcloud ks ingress alb autoupdate disable

3. When automatic updates for the Ingress ALBs are disabled, you can force a one-time update of your ALBs with the following command:

   ibmcloud ks ingress alb update --version 1.9.4_5698_iks

After you force a one-time update, automatic updates will need to remain disabled until version 1.9.4_5698_iks or later is marked as the default version.

Action Required (after version 1.9.4_5698_iks or later is marked as default)

1. Verify your IBM Cloud Kubernetes Service clusters with Kubernetes Ingress application load balancers (ALBs) are no longer exposed to these vulnerabilities, use the following IBM Cloud CLI command to list all Ingress ALB IDs in a cluster to confirm the version:

   ibmcloud ks ingress alb ls

If the versions are at version 1.9.4_5698_iks or later, they are no longer exposed.
2. Use the following IBM Cloud CLI command to confirm current the configuration of autoupdates:

    ibmcloud ks ingress alb autoupdate get

If autoupdates are disabled, use the following IBM Cloud CLI command to re-enable the automatic updates by IBM when a new default image version is made available:

    ibmcloud ks ingress alb autoupdate enable