A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use the custom snippets feature to obtain all secrets in the cluster.
### Issue Details
A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use the custom snippets feature to obtain all secrets in the cluster.

This issue has been rated **High** ([CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L)), and assigned **CVE-2021-25742**.

### Affected Components and Configurations
This bug affects ingress-nginx.

Multitenant environments where non-admin users have permissions to create Ingress objects are most affected by this issue.

#### Affected Versions with no mitigation

- v1.0.0
- <= v0.49.0

#### Versions allowing mitigation
This issue cannot be fixed solely by upgrading ingress-nginx. It can be mitigated in the following versions:
- v1.0.1
- v0.49.1

### Mitigation
To mitigate this vulnerability:
1. Upgrade to a version that allows mitigation, (>= v0.49.1 or >= v1.0.1)
2. Set [allow-snippet-annotations](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#allow-snippet-annotations) to false in your ingress-nginx ConfigMap based on how you deploy ingress-nginx:

    **Static Deploy Files** 
    Edit the ConfigMap for ingress-nginx **after** deployment:
    ```
    kubectl edit configmap -n ingress-nginx ingress-nginx-controller
    ```
    Add directive:
    ````
    data:
      allow-snippet-annotations: “false”
     ````
    More information on the ConfigMap [here](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/) 

    **Deploying Via Helm**
    Set `controller.allowSnippetAnnotations` to `false` in the Values.yaml or add the directive to the helm deploy:
    ```
    helm install [RELEASE_NAME] --set controller.allowSnippetAnnotations=false ingress-nginx/ingress-nginx
    ````

    [https://github.com/kubernetes/ingress-nginx/blob/controller-v1.0.1/charts/ingress-nginx/values.yaml#L76](https://github.com/kubernetes/ingress-nginx/blob/controller-v1.0.1/charts/ingress-nginx/values.yaml#L76)

### Detection
If you find evidence that this vulnerability has been exploited, please contact security@kubernetes.io
Additional Details
See ingress-nginx Issue #7837 for more details.

### Acknowledgements
This vulnerability was reported by Mitch Hulscher.

Thank You,
CJ Cullen on behalf of the Kubernetes Security Response Committee

CVE-2021-25742: Ingress-nginx custom snippets allows retrieval of ingress-nginx serviceaccount token and secrets across all namespaces
This is a GitHub Issue
repo:ingress-nginx
owner:kubernetes
Title : CVE-2021-25742: Ingress-nginx custom snippets allows retrieval of ingress-nginx serviceaccount token and secrets across all namespaces
Issue date:

--- start body ---
### Issue Details
A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use the custom snippets feature to obtain all secrets in the cluster.

This issue has been rated **High** ([CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L)), and assigned **CVE-2021-25742**.

### Affected Components and Configurations
This bug affects ingress-nginx.

Multitenant environments where non-admin users have permissions to create Ingress objects are most affected by this issue.

#### Affected Versions with no mitigation

- v1.0.0
- <= v0.49.0

#### Versions allowing mitigation
This issue cannot be fixed solely by upgrading ingress-nginx. It can be mitigated in the following versions:
- v1.0.1
- v0.49.1

### Mitigation
To mitigate this vulnerability:
1. Upgrade to a version that allows mitigation, (>= v0.49.1 or >= v1.0.1)
2. Set [allow-snippet-annotations](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#allow-snippet-annotations) to false in your ingress-nginx ConfigMap based on how you deploy ingress-nginx:

    **Static Deploy Files** 
    Edit the ConfigMap for ingress-nginx **after** deployment:
    ```
    kubectl edit configmap -n ingress-nginx ingress-nginx-controller
    ```
    Add directive:
    ````
    data:
      allow-snippet-annotations: “false”
     ````
    More information on the ConfigMap [here](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/) 

    **Deploying Via Helm**
    Set `controller.allowSnippetAnnotations` to `false` in the Values.yaml or add the directive to the helm deploy:
    ```
    helm install [RELEASE_NAME] --set controller.allowSnippetAnnotations=false ingress-nginx/ingress-nginx
    ````

    [https://github.com/kubernetes/ingress-nginx/blob/controller-v1.0.1/charts/ingress-nginx/values.yaml#L76](https://github.com/kubernetes/ingress-nginx/blob/controller-v1.0.1/charts/ingress-nginx/values.yaml#L76)

### Detection
If you find evidence that this vulnerability has been exploited, please contact security@kubernetes.io
Additional Details
See ingress-nginx Issue #7837 for more details.

### Acknowledgements
This vulnerability was reported by Mitch Hulscher.

Thank You,
CJ Cullen on behalf of the Kubernetes Security Response Committee

--- end body ---
