Exposed Ingress NGINX Admission Controller Nuclei Template

id: exposed-ingress-nginx-admission

info:
  name: Publicly exposed Ingress NGINX Admission
  author: Wiz research
  severity: high
  description: Ingress Nginx admission controller endpoint should not be exposed
  metadata:
    max-request: 1
  tags: ssl,tls

ssl:
  - address: "{{Host}}:{{Port}}"

    matchers:
      - type: dsl
        dsl:
          - 'contains(issuer_org, "nil1")'
          - 'contains(subject_org, "nil2")'
          - 'contains(subject_an, "nginx")'
        condition: and

    extractors:
      - type: json
        name: issuer_org
        json:
            - ".issuer_org[0]"
          
      - type: json
        name: subject_org
        json:
            - ".subject_org[0]"
     
      - type: json
        name: subject_an
        json:
            - ".subject_an[0]" 

hi Nir, first of all thanks for the template.
I have just learnt about the IngressNightmare vulnerability and unfortunately have no experience with the Nuclei tool.
I've just tested it on our Ingress controller and I'm not sure how to interpret the result.

I downloaded your template and executed it as follows, against one Domain on the load balancer:
nuclei -u https://host.example.com -t ./exposed-ingress-nginx-admission.yaml -stats
the output is:
[INF] Current nuclei version: v3.4.0 (latest)
[INF] Current nuclei-templates version: v10.1.5 (latest)
[WRN] Scan results upload to cloud is disabled.
[INF] New templates added in latest release: 281
[INF] Templates loaded for current scan: 1
[WRN] Loading 1 unsigned templates for scan. Use with caution.
[INF] Targets loaded for current scan: 1
[INF] No results found. Better luck next time!
[0:00:01] | Templates: 1 | Hosts: 1 | RPS: 0 | Matched: 0 | Errors: 0 | Requests: 0/1 (0%)

says No results found. Better luck next time!
and RPS: 0 | Matched: 0 | Errors: 0 | Requests: 0/1 (0%)
that no vulnerability was found or that the request was not successfully executed?
unfortunately I did not find any hints in the nuclei docu.
Thanks for your work!
with best regards
alex

Hello @atoolchain, you can use these debug command with nuclei :

-debug show all requests and responses
-dreq, -debug-req show all sent requests
-dresp, -debug-resp show all received responses

I think it can help you to identify a problem or not.

Oh and i see that you don't specify a port. You can modify the {{Port}} variable and define 80 or 443 for example.

Hi @atoolchain for me its also coming same like urs , can u plz tell how u veried

Thanks for the template