CVEs-PoC/2021/CVE-2021-25745.md

### [CVE-2021-25745](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25745)
![](https://img.shields.io/static/v1?label=Product&message=Kubernetes%20ingress-nginx&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=%3C%201.2.0%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-20%3A%20Improper%20Input%20Validation&color=brighgreen)

### Description

A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use the spec.rules[].http.paths[].path field of an Ingress object (in the networking.k8s.io or extensions API group) to obtain the credentials of the ingress-nginx controller. In the default configuration, that credential has access to all secrets in the cluster.

### POC

#### Reference
No PoCs from references.

#### Github
- https://github.com/cloud-Xolt/CVE
- https://github.com/kajogo777/kubernetes-misconfigured