github - ghsa-242m-6h72-7hgp

ghsa-242m-6h72-7hgp

Vulnerability from github

Published

2025-03-25 00:30

Modified

2025-03-25 15:10

Severity ?

4.8 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L

Summary

ingress-nginx controller - auth secret file path traversal vulnerability

Details

A security issue was discovered in ingress-nginx where attacker-provided data are included in a filename by the ingress-nginx Admission Controller feature, resulting in directory traversal within the container. This could result in denial of service, or when combined with other vulnerabilities, limited disclosure of Secret objects from the cluster.

Show details on source website

JSON

To clipboard

{
   affected: [
      {
         package: {
            ecosystem: "Go",
            name: "k8s.io/ingress-nginx",
         },
         ranges: [
            {
               events: [
                  {
                     introduced: "0",
                  },
                  {
                     fixed: "1.11.5",
                  },
               ],
               type: "ECOSYSTEM",
            },
         ],
      },
      {
         package: {
            ecosystem: "Go",
            name: "k8s.io/ingress-nginx",
         },
         ranges: [
            {
               events: [
                  {
                     introduced: "1.12.0-beta.0",
                  },
                  {
                     fixed: "1.12.1",
                  },
               ],
               type: "ECOSYSTEM",
            },
         ],
      },
   ],
   aliases: [
      "CVE-2025-24513",
   ],
   database_specific: {
      cwe_ids: [
         "CWE-20",
         "CWE-22",
      ],
      github_reviewed: true,
      github_reviewed_at: "2025-03-25T15:10:08Z",
      nvd_published_at: "2025-03-25T00:15:14Z",
      severity: "MODERATE",
   },
   details: "A security issue was discovered in [ingress-nginx](https://github.com/kubernetes/ingress-nginx) where attacker-provided data are included in a filename by the ingress-nginx Admission Controller feature, resulting in directory traversal within the container. This could result in denial of service, or when combined with other vulnerabilities, limited disclosure of Secret objects from the cluster.",
   id: "GHSA-242m-6h72-7hgp",
   modified: "2025-03-25T15:10:08Z",
   published: "2025-03-25T00:30:26Z",
   references: [
      {
         type: "ADVISORY",
         url: "https://nvd.nist.gov/vuln/detail/CVE-2025-24513",
      },
      {
         type: "WEB",
         url: "https://github.com/kubernetes/kubernetes/issues/131005",
      },
      {
         type: "PACKAGE",
         url: "https://github.com/kubernetes/ingress-nginx",
      },
      {
         type: "WEB",
         url: "https://github.com/kubernetes/ingress-nginx/releases/tag/controller-v1.11.5",
      },
      {
         type: "WEB",
         url: "https://github.com/kubernetes/ingress-nginx/releases/tag/controller-v1.12.1",
      },
      {
         type: "WEB",
         url: "https://groups.google.com/g/kubernetes-security-announce/c/2qa9DFtN0cQ",
      },
   ],
   schema_version: "1.4.0",
   severity: [
      {
         score: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L",
         type: "CVSS_V3",
      },
   ],
   summary: "ingress-nginx controller - auth secret file path traversal vulnerability",
}

cve-2025-24513

Vulnerability from cvelistv5

Published

2025-03-24 23:29

Modified

2025-03-25 13:39

Severity ?

4.8 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L

Summary

A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where attacker-provided data are included in a filename by the ingress-nginx Admission Controller feature, resulting in directory traversal within the container. This could result in denial of service, or when combined with other vulnerabilities, limited disclosure of Secret objects from the cluster.

References

▼	URL	Tags
	https://github.com/kubernetes/kubernetes/issues/131005

Impacted products

	Vendor	Product	Version
	kubernetes	ingress-nginx	Version: 0 ≤ 1.11.4 Version: 1.12.0

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2025-24513",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-03-25T13:39:36.149148Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-03-25T13:39:50.057Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unaffected",
               product: "ingress-nginx",
               repo: "https://github.com/kubernetes/ingress-nginx",
               vendor: "kubernetes",
               versions: [
                  {
                     lessThanOrEqual: "1.11.4",
                     status: "affected",
                     version: "0",
                     versionType: "semver",
                  },
                  {
                     status: "affected",
                     version: "1.12.0",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               type: "finder",
               value: "Nir Ohfeld",
            },
            {
               lang: "en",
               type: "finder",
               value: "Ronen Shustin",
            },
         ],
         datePublic: "2025-03-24T19:36:00.000Z",
         descriptions: [
            {
               lang: "en",
               supportingMedia: [
                  {
                     base64: false,
                     type: "text/html",
                     value: "A security issue was discovered in <a target=\"_blank\" rel=\"nofollow\" href=\"https://github.com/kubernetes/ingress-nginx\">ingress-nginx</a> where attacker-provided data are included in a filename by the ingress-nginx Admission Controller feature, resulting in directory traversal within the container. This could result in denial of service, or when combined with other vulnerabilities, limited disclosure of Secret objects from the cluster.",
                  },
               ],
               value: "A security issue was discovered in  ingress-nginx https://github.com/kubernetes/ingress-nginx  where attacker-provided data are included in a filename by the ingress-nginx Admission Controller feature, resulting in directory traversal within the container. This could result in denial of service, or when combined with other vulnerabilities, limited disclosure of Secret objects from the cluster.",
            },
         ],
         impacts: [
            {
               capecId: "CAPEC-126",
               descriptions: [
                  {
                     lang: "en",
                     value: "CAPEC-126 Path Traversal",
                  },
               ],
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "LOW",
                  baseScore: 4.8,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "LOW",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L",
                  version: "3.1",
               },
               format: "CVSS",
               scenarios: [
                  {
                     lang: "en",
                     value: "GENERAL",
                  },
               ],
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-20",
                     description: "CWE-20 Improper Input Validation",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2025-03-24T23:29:25.215Z",
            orgId: "a6081bf6-c852-4425-ad4f-a67919267565",
            shortName: "kubernetes",
         },
         references: [
            {
               url: "https://github.com/kubernetes/kubernetes/issues/131005",
            },
         ],
         source: {
            discovery: "EXTERNAL",
         },
         title: "ingress-nginx controller - auth secret file path traversal vulnerability",
         x_generator: {
            engine: "Vulnogram 0.2.0",
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "a6081bf6-c852-4425-ad4f-a67919267565",
      assignerShortName: "kubernetes",
      cveId: "CVE-2025-24513",
      datePublished: "2025-03-24T23:29:25.215Z",
      dateReserved: "2025-01-23T00:50:17.928Z",
      dateUpdated: "2025-03-25T13:39:50.057Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted