CVE-2023-5043 Ingress nginx annotation injection causes arbitrary command execution
Attackers can inject malicious annotations into Ingress resources to execute arbitrary commands on the ingress-nginx controller.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-5043?
CVE-2023-5043 is a high-severity command injection vulnerability in Kubernetes ingress-nginx, published on 25 Oct 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Ingress nginx annotation injection causes arbitrary command execution.
Which versions are affected by CVE-2023-5043?
2 open source packages ship an affected version, including k8s.io/ingress-nginx. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
k8s.io/ingress-nginx Go | All versions | 1.9.0 |
k8s.io/ingress-nginx Go | All versions | 1.9.0 |
Products include Kubernetes Ingress-Nginx.
How do I fix CVE-2023-5043?
Upgrade k8s.io/ingress-nginx to 1.9.0 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2023-5043 being exploited?
There is no known exploitation of CVE-2023-5043 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Kubernetes ingress-nginx
- CVE-2026-3288 ingress-nginx rewrite-target nginx configuration injection
- CVE-2022-4886 Ingress-nginx `path` sanitization can be bypassed with `log_format` directive
- CVE-2023-5044 Code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation
- CVE-2021-25748 Ingress-nginx `path` sanitization can be bypassed with newline character
- CVE-2021-25745 Ingress-nginx path can be pointed to service account token file
Sources
Also known as GHSA-5wj4-wffq-3378.