F5-K000162609: SSRF
NGINX Gateway Fabric has a vulnerability when it renders spec.basic.realm and spec.jwt.realm of a namespaced AuthenticationFilter Custom Resource Definition (CRD) verbatim, unescaped and unvalidated, into the shared data plane nginx.conf as authbasic "<realm>";. A namespaced authenticated attacker that configures the AuthenticationFilter CRD to an HTTPRoute/GRPCRoute on a shared Gateway can craft a realm value that closes the quoted directive and the enclosing location {} block and injects arbitrary NGINX directives into that Gateway's data plane configuration.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.8.0
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Deployments using a shared Gateway are exposed when a namespaced authenticated user can configure an AuthenticationFilter CRD and attach it to an HTTPRoute or GRPCRoute on that Gateway. The injected configuration affects the shared Gateway data plane.
What access does an attacker need?
The attacker needs authenticated, namespaced access sufficient to configure an AuthenticationFilter Custom Resource Definition and associate it with an HTTPRoute or GRPCRoute on a shared Gateway. No user interaction is required.
Which AuthenticationFilter values are relevant for exploitation?
The affected values are spec.basic.realm and spec.jwt.realm. A crafted realm can terminate the quoted auth_basic directive and its enclosing location block, allowing arbitrary NGINX directives to be injected into the Gateway data plane configuration.