CVE-2023-5044 Code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation

What is CVE-2023-5044?

CVE-2023-5044 is a high-severity code injection vulnerability in Kubernetes ingress-nginx, published on 25 Oct 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation.

Weakness: CWE-94, CWE-20

Which versions are affected by CVE-2023-5044?

3 open source packages ship an affected version, including k8s.io/ingress-nginx. It affects 1 product.

Products include Kubernetes Ingress-Nginx.

How do I fix CVE-2023-5044?

Upgrade k8s.io/ingress-nginx to 1.9.0 or later.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2023-5044 being exploited?

There is no known exploitation of CVE-2023-5044 in the wild and no public exploit code.

Public exploit code: 3 proofs of concept on GitHub.

Other vulnerabilities in Kubernetes ingress-nginx

• CVE-2026-3288 ingress-nginx rewrite-target nginx configuration injection High 8.8
• CVE-2022-4886 Ingress-nginx `path` sanitization can be bypassed with `log_format` directive High 8.8
• CVE-2023-5043 Ingress nginx annotation injection causes arbitrary command execution High 7.6
• CVE-2021-25748 Ingress-nginx `path` sanitization can be bypassed with newline character High 7.6
• CVE-2021-25745 Ingress-nginx path can be pointed to service account token file High 7.6

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-fp9f-44c2-cw27, GO-2024-2428, MINI-2332-qhrh-8frv, MINI-37j5-588g-r59j, MINI-387g-72cj-rcp8, MINI-3p33-v4vv-crr3 and 6 more.