Hasnain says:

I’ve been trying to learn more exploit dev, and I thought I was getting slowly better, then I look up the exploit chain of things like this and I’m like uhhhh

“We are only scratching the surface in reviewing the security of admission controllers. Initially, we were surprised to see that such a large code base is used behind the scenes. In our view, this attack surface should be restricted in a much better way: removing access from pods within the cluster, and never exposing this publicly. We were also surprised by the lack of least-privilege design, as the exploit ended up with privileges to take control of the cluster. During this research, we found other vulnerabilities in Ingress NGINX Controller, and we expect to find more in other admission controllers. “

Posted on 2025-03-26T05:45:50+0000