Injection in path parameter of Ingress-nginx
该报告还没有中文解读。
原文摘录
摘自原文(4574 字符中的一小部分)
The objective of an Ingress Controller is to act as a gatekeeper for all incoming traffic to a Kubernetes cluster. It is responsible for routing and managing traffic coming into the cluster from external sources, allowing for efficient and secure communication between the cluster and the outside …
原文中的代码
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
annotations:
kubernetes.io/ingress.class: nginx
name: f292392-research
namespace: default
spec:
rules:
- host: f292392.com
http:
paths:
- backend:
service:
name: legitimate-service …默认不展示报告全文。以上为简短摘录,完整复现过程请阅读原文。版权归研究员与 Kubernetes 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @fisjkars · 版权归作者与 Kubernetes 所有