CVE-2023-5043: K8s.io/ingress nginx Ingress Nginx Annotation Injection Causes Vulnerability
HIGHCVE-2023-5043 is a HIGH (CVSS 7.6) ingress nginx annotation injection causes vulnerability (CWE-20: Improper Input Validation) affecting K8s.io/ingress nginx libraries in the Go ecosystem. The issue involves ingress nginx annotation injection causes arbitrary command execution. Remediation is available by upgrading affected packages to version 1.9.0.
CVE-2023-5043 at a Glance
Security Impact
CVSS: 7.6
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L).
How to Fix CVE-2023-5043
To remediate this vulnerability, upgrade all affected K8s.io/ingress nginx dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
Upgrade k8s.io/ingress-nginx to 1.9.0Run the following command in your project directory to verify that all resolved dependencies use the patched release:
inspect dependencies for k8s.io/ingress-nginxHow to Check if You Are Affected
To determine whether your application is affected by CVE-2023-5043, inspect your project dependencies for K8s.io/ingress nginx:
inspect dependencies for k8s.io/ingress-nginxAnalyze the terminal output to locate any version of K8s.io/ingress nginx in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 1.9.0), your application is affected.
Note: Verify declared build manifests and deployed runtime container environments.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-20: Improper Input Validation, where the product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. In K8s.io/ingress nginx, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2023-5043 Affected K8s.io/ingress nginx Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
k8s.io/ingress-nginx
|
Go |
< 1.9.0
|
1.9.0
|
References
Frequently Asked Questions
What is CVE-2023-5043?
Which K8s.io/ingress nginx versions are affected?
What version fixes CVE-2023-5043?
Is k8s.io/ingress-nginx affected?
What is the CVSS score of CVE-2023-5043?
What CWE is associated with CVE-2023-5043?
How can I check Go dependencies for CVE-2023-5043?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-5wj4-wffq-3378",
"modified" : "2025-02-13T19:18:20Z",
"published" : "2023-10-25T21:30:33Z",
"aliases" : [ "CVE-2023-5043" ],
"summary" : "Ingress nginx annotation injection causes arbitrary command execution",
"details" : "### Issue Details\nA security issue was identified in ingress-nginx where the nginx.ingress.kubernetes.io/configuration-snippet annotation on an Ingress object (in the networking.k8s.io or extensions API group) can be used to inject arbitrary commands, and obtain the credentials of the ingress-nginx controller. In the default configuration, that credential has access to all secrets in the cluster.\n\nThis issue has been rated High (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L), and assigned CVE-2023-5043.\n\n### Affected Components and Configurations\nThis bug affects ingress-nginx. If you do not have ingress-nginx installed on your cluster, you are not affected. You can check this by running kubectl get po -n ingress-nginx.\n\nIf you are running the “chrooted” ingress-nginx controller introduced in v1.2.0 (gcr.io/k8s-staging-ingress-nginx/controller-chroot), command execution is possible but credential extraction is not, so the High severity does not apply.\n\nMulti-tenant environments where non-admin users have permissions to create Ingress objects are most affected by this issue.\n\n#### Affected Versions\n<v1.9.0\n#### Versions allowing mitigation\nv1.9.0\n### Mitigation\nIngress Administrators should set the --enable-annotation-validation flag to enforce restrictions on the contents of ingress-nginx annotation fields.\n\n### Detection\nIf you find evidence that this vulnerability has been exploited, please contact security@kubernetes.io\n\n### Additional Details\nSee ingress-nginx Issue [#10571](https://github.com/kubernetes/ingress-nginx/issues/10571) for more details.\n\n### Acknowledgements\nThis vulnerability was reported by suanve\n\nThank You,\nCJ Cullen on behalf of the Kubernetes Security Response Committee",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "Go",
"name" : "k8s.io/ingress-nginx"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "1.9.0"
} ]
} ]
} ],
"references" : [ {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2023-5043"
}, {
"type" : "WEB",
"url" : "https://github.com/kubernetes/ingress-nginx/issues/10571"
}, {
"type" : "WEB",
"url" : "https://groups.google.com/g/kubernetes-security-announce/c/pVsXsOpxYZo"
}, {
"type" : "WEB",
"url" : "https://security.netapp.com/advisory/ntap-20240307-0012"
}, {
"type" : "WEB",
"url" : "http://www.openwall.com/lists/oss-security/2023/10/25/4"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-20", "CWE-74" ],
"severity" : "HIGH",
"github_reviewed" : true,
"github_reviewed_at" : "2023-11-03T19:13:55Z",
"nvd_published_at" : "2023-10-25T20:15:18Z"
}
}