¡¾Îó²îͨ¸æ¡¿Kubernetes ingress-nginx¿ØÖÆÆ÷í§Òâ´úÂëÖ´ÐÐÎó²î(CVE-2025-1974)

Ðû²¼Ê±¼ä 2025-03-28

Ò»¡¢Îó²î¸ÅÊö


Îó²îÃû³Æ

Kubernetes ingress-nginx¿ØÖÆÆ÷í§Òâ´úÂëÖ´ÐÐÎó²î

CVE   ID

CVE-2025-1974

Îó²îÀàÐÍ

Ô¶³Ì´úÂëÖ´ÐÐ

·¢Ã÷ʱ¼ä

2025-03-28

Îó²îÆÀ·Ö

9.8

Îó²îÆ·¼¶

ÑÏÖØ

¹¥»÷ÏòÁ¿

ÍøÂç

ËùÐèȨÏÞ

ÎÞ

ʹÓÃÄѶÈ

µÍ

Óû§½»»¥

²»ÐèÒª

PoC/EXP

ÒѹûÕæ

ÔÚҰʹÓÃ

δ·¢Ã÷


ingress-nginx¿ØÖÆÆ÷ÊÇKubernetesÖеÄÒ»¸öÒªº¦×é¼þ£¬£¬ £¬£¬£¬£¬ÓÃÓÚÖÎÀí¼¯ÈºÄÚ²¿ºÍÍⲿÁ÷Á¿µÄ»á¼û¿ØÖÆ¡£¡£¡£¡£¡£Ëüͨ¹ý½ç˵Ingress×ÊÔ´À´ÉèÖÃHTTPºÍHTTPS·ÓÉ£¬£¬ £¬£¬£¬£¬ÊµÏÖ¸ºÔØƽºâ¡¢SSLÖÕÖ¹¡¢·´ÏòÊðÀíµÈ¹¦Ð§¡£¡£¡£¡£¡£¸Ã¿ØÖÆÆ÷»ùÓÚNGINX£¬£¬ £¬£¬£¬£¬Ö§³ÖÎÞаµÄÁ÷Á¿ÖÎÀíÕ½ÂԺ͸߿ÉÀ©Õ¹ÐÔ¡£¡£¡£¡£¡£


2025Äê3ÔÂ28ÈÕ£¬£¬ £¬£¬£¬£¬ÈËÉú¾ÍÊDz©¼¯ÍÅVSRC¼à²âµ½KubernetesÐû²¼µÄÇ徲ͨ¸æ£¬£¬ £¬£¬£¬£¬Ö¸³öÔÚKubernetesÖз¢Ã÷ÁËÒ»¸öÑÏÖصÄÇå¾²Îó²î£¬£¬ £¬£¬£¬£¬¸ÃÎó²îÓ°Ïìingress-nginx¿ØÖÆÆ÷¡£¡£¡£¡£¡£Î´¾­Éí·ÝÑéÖ¤µÄ¹¥»÷Õß½öÐè»á¼ûPodÍøÂ磬£¬ £¬£¬£¬£¬±ã¿ÉÔÚingress-nginx¿ØÖÆÆ÷ÉÏÏÂÎÄÖÐÖ´ÐÐí§Òâ´úÂ룬£¬ £¬£¬£¬£¬½ø¶øй¶¿ØÖÆÆ÷¿É»á¼ûµÄSecrets¡£¡£¡£¡£¡£Ä¬ÈÏÇéÐÎÏ£¬£¬ £¬£¬£¬£¬ingress-nginx¿ØÖÆÓþßÓлá¼ûÕû¸ö¼¯ÈºËùÓÐSecretsµÄȨÏÞ¡£¡£¡£¡£¡£¸ÃÎó²îµÄCVSSÆÀ·ÖΪ9.8·Ö£¬£¬ £¬£¬£¬£¬Îó²îÆ·¼¶ÑÏÖØ¡£¡£¡£¡£¡£


¶þ¡¢Ó°Ïì¹æÄ£


ingress-nginx < v1.11.0

v1.11.0 <= ingress-nginx <= 1.11.4
ingress-nginx = v1.12.0


Èý¡¢Çå¾²²½·¥


3.1 Éý¼¶°æ±¾


¹Ù·½ÒÑÐû²¼ÐÞ¸´°æ±¾ingress-nginx v1.12.1ºÍv1.11.5£¬£¬ £¬£¬£¬£¬½¨ÒéÊÜÓ°ÏìÓû§¾¡¿ì¸üС£¡£¡£¡£¡£


ÏÂÔØÁ´½Ó£ºhttps://github.com/kubernetes/ingress-nginx/releases/


3.2 ÔÝʱ²½·¥


? ¿ÉÒÔͨ¹ý½ûÓÃingress-nginxµÄValidating Admission Controller¹¦Ð§À´ÏÔÖø½µµÍΣº¦¡£¡£¡£¡£¡£
? ÈôÊÇʹÓÃHelm×°ÖÃingress-nginx£ºÖØÐÂ×°Ö㬣¬ £¬£¬£¬£¬²¢ÉèÖÃHelmÖµcontroller.admissionWebhooks.enabled=false¡£¡£¡£¡£¡£
? ÈôÊÇÊÖ¶¯×°ÖÃingress-nginx£ºÉ¾³ýÃûΪingress-nginx-admissionµÄValidatingWebhookConfiguration¡£¡£¡£¡£¡£±à¼­ingress-nginx-controllerµÄDeployment»òDaemonSet£¬£¬ £¬£¬£¬£¬ÒƳý¿ØÖÆÆ÷ÈÝÆ÷²ÎÊýÁбíÖеÄ--validating-webhook¡£¡£¡£¡£¡£


3.3 ͨÓý¨Òé


? °´ÆÚ¸üÐÂϵͳ²¹¶¡£¬£¬ £¬£¬£¬£¬ïÔ̭ϵͳÎó²î£¬£¬ £¬£¬£¬£¬ÌáÉýЧÀÍÆ÷µÄÇå¾²ÐÔ¡£¡£¡£¡£¡£
? ÔöǿϵͳºÍÍøÂçµÄ»á¼û¿ØÖÆ£¬£¬ £¬£¬£¬£¬Ð޸ķÀ»ðǽսÂÔ£¬£¬ £¬£¬£¬£¬¹Ø±Õ·ÇÐëÒªµÄÓ¦Óö˿ڻòЧÀÍ£¬£¬ £¬£¬£¬£¬ïÔÌ­½«Î£ÏÕЧÀÍ£¨ÈçSSH¡¢RDPµÈ£©Ì»Â¶µ½¹«Íø£¬£¬ £¬£¬£¬£¬ïÔÌ­¹¥»÷Ãæ¡£¡£¡£¡£¡£
? Ê¹ÓÃÆóÒµ¼¶Çå¾²²úÆ·£¬£¬ £¬£¬£¬£¬ÌáÉýÆóÒµµÄÍøÂçÇå¾²ÐÔÄÜ¡£¡£¡£¡£¡£
? ÔöǿϵͳÓû§ºÍȨÏÞÖÎÀí£¬£¬ £¬£¬£¬£¬ÆôÓöàÒòËØÈÏÖ¤»úÖƺÍ×îСȨÏÞÔ­Ôò£¬£¬ £¬£¬£¬£¬Óû§ºÍÈí¼þȨÏÞÓ¦¼á³ÖÔÚ×îµÍÏ޶ȡ£¡£¡£¡£¡£
? ÆôÓÃÇ¿ÃÜÂëÕ½ÂÔ²¢ÉèÖÃΪ°´ÆÚÐ޸ġ£¡£¡£¡£¡£


3.4 ²Î¿¼Á´½Ó


https://github.com/kubernetes/kubernetes/issues/131009
https://nvd.nist.gov/vuln/detail/CVE-2025-1974
https://kubernetes.io/blog/2025/03/24/ingress-nginx-cve-2025-1974/