PoC Exploit Released for Ingress-NGINX RCE Vulnerabilities

A recently disclosed vulnerability in Ingress-NGINX, tracked as CVE-2025-1974, has raised concerns about the security of Kubernetes environments.

This vulnerability allows for Remote Code Execution (RCE) through the validating webhook server integrated into Ingress-NGINX. A Proof of Concept (PoC) exploit has been released, demonstrating how attackers could exploit this flaw.

CVE-2025-1974 affects versions of Ingress-NGINX where the validating webhook is enabled. The webhook listens on port 8443 and is designed to validate configurations before applying them to NGINX instances.

However, due to a security oversight, an attacker can craft malicious AdmissionRequests containing NGINX configurations that lead to RCE.

PoC Exploit

The PoC exploit has been tested in a local Minikube environment. Here’s a step-by-step guide on how it works:

1. Create a Vulnerable Pod:
   Users start by applying the relevant NGINX Ingress controller configuration using Kubernetes:

kubectl apply -f nginx-ingress-controller.yaml

2. Identify the Webhook Server:
   Describing the pod reveals details about the webhook server, including its listening port:

kubectl describe <pod name> -n <namespace>

This shows that the validating webhook is listening on port 8443.

3. Port Forward to Local Machine:
   To interact with the webhook, users port-forward it to their local machine:

kubectl port-forward -n ingress-nginx <pod name> 8443:1337

4. Send Malicious AdmissionRequest:
   A malicious AdmissionRequest is crafted with a JSON payload (poc.json) containing an NGINX configuration that exploits the vulnerability. This is sent to the forwarded webhook port:

curl --insecure -v -H "Content-Type: application/json" --data poc.json https://localhost:1337/fake/path

5. Verify Successful Execution:
   The logs of the pod are checked using:

kubectl logs <pod name> -n ingress-nginx

Successful execution of the exploit is indicated by specific log messages.

Impact and Recommendations

This vulnerability poses a significant risk to any environment that relies on Ingress-NGINX with the validating webhook enabled.

The potential for RCE allows attackers to execute arbitrary code within the Kubernetes cluster, compromising security and integrity.

To mitigate this vulnerability, users are advised to update their Ingress-NGINX installations to versions where the issue has been fixed.

Additionally, ensuring proper network segmentation and access controls can limit potential damage until patches are applied.

The release of a PoC exploit for CVE-2025-1974 highlights the urgency of addressing vulnerabilities in critical infrastructure components like Ingress-NGINX.

Continuous monitoring and maintenance of Kubernetes environments are essential to prevent such exploits from being successfully executed in the wild.

As the Kubernetes ecosystem continues to evolve, securing each component against emerging threats remains a top priority for operators and developers alike.

Are you from SOC/DFIR Teams? – Analyse Malware, Phishing Incidents & get live Access with ANY.RUN -> Start Now for Free.