CVEs-PoC/2021/CVE-2021-25742.md

### [CVE-2021-25742](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25742)
![](https://img.shields.io/static/v1?label=Product&message=Kubernetes%20ingress-nginx&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen)
![](https://img.shields.io/static/v1?label=Version&message=unspecified%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-20%3A%20Improper%20Input%20Validation&color=brightgreen)

### Description

A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use the custom snippets feature to obtain all secrets in the cluster.

### POC

#### Reference
No PoCs from references.

#### Github
- https://github.com/ARPSyndicate/cvemon
- https://github.com/EGI-Federation/SVG-advisories
- https://github.com/FishAnonymous/CAShift-Record
- https://github.com/cloud-Xolt/CVE
- https://github.com/cruise-automation/k-rail
- https://github.com/kajogo777/kubernetes-misconfigured
- https://github.com/khu-capstone-design/kubernetes-vulnerability-investigation
- https://github.com/mnbf9rca/kubernetes_config
- https://github.com/noirfate/k8s_debug
- https://github.com/ruben-rodriguez/micro-frontends-in-k8s