CVE-2023-5043: 
Ingress NGINX Controller (community-driven) vulnerability analysis and mitigation

A critical security vulnerability (CVE-2023-5043) was identified in ingress-nginx where the nginx.ingress.kubernetes.io/configuration-snippet annotation on an Ingress object can be exploited for arbitrary command execution. The vulnerability affects versions prior to 1.9.0 and was discovered in October 2023. This issue has been rated High with a CVSS score of 8.8 (Kubernetes Security, NetApp Advisory).

The vulnerability exists in the ingress-nginx controller where the nginx.ingress.kubernetes.io/configuration-snippet annotation on an Ingress object (in the networking.k8s.io or extensions API group) can be exploited to inject arbitrary commands. In the default configuration, the compromised credential has access to all secrets in the cluster. The vulnerability has been assigned a CVSS score of 8.8 (HIGH) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (OSS Security, NetApp Advisory).

When successfully exploited, this vulnerability can lead to disclosure of sensitive information, including the ability to obtain the credentials of the ingress-nginx controller. In the default configuration, these credentials have access to all secrets in the cluster. Multi-tenant environments where non-admin users have permissions to create Ingress objects are most affected by this issue (Security Online, OSS Security).

Organizations should update to ingress-nginx version 1.9.0 or later to address this vulnerability. For environments where immediate updating is not possible, users should verify if they have ingress-nginx installed by running 'kubectl get po -n ingress-nginx'. Additionally, implementing strict access controls for Ingress object creation and using the chrooted ingress-nginx controller can help mitigate the risk (GitHub Issue).

The vulnerability was reported by security researcher suanve and was quickly acknowledged by the Kubernetes Security Response Committee. The discovery prompted immediate security advisories from major organizations including NetApp and led to increased scrutiny of Kubernetes ingress controller security (OSS Security).