ingress-nginx-valid-admission: Kubernetes Ingress-Nginx Valid AdmissionReview - Detection

id: ingress-nginx-valid-admission

info:
  name: Kubernetes Ingress-Nginx Valid AdmissionReview - Detection
  author: burso
  severity: unknown
  description: |
    Sends a valid minimal AdmissionReview JSON to reliably detect Kubernetes Ingress-Nginx Admission webhook endpoints.
  metadata:
    verified: true
    max-request: 1
    shodan-query: ssl:"ingress-nginx" port:8443
  tags: tech,kubernetes,ingress,nginx,k8s,vuln

variables:
  string: "{{to_lower(rand_base(5))}}"

http:
  - raw:
      - |
        POST /validate HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {
          "kind": "AdmissionReview",
          "apiVersion": "admission.k8s.io/v1",
          "request": {
            "uid": "{{string}}",
            "kind": {
              "group": "networking.k8s.io",
              "version": "v1",
              "kind": "Ingress"
            },
            "operation": "CREATE",
            "object": {
              "metadata": {
                "name": "test-{{string}}",
                "namespace": "default"
              },
              "spec": {
                "rules": [
                  {
                    "host": "example.com",
                    "http": {
                      "paths": []
                    }
                  }
                ]
              }
            }
          }
        }

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "application/json")'
          - 'contains_all(body, "AdmissionReview", "test-{{string}}")'
        condition: and
# digest: 4a0a00473045022100bca20c7e179cbb8163c54bb3b45fdfb326776485ec49557139d89190c317aa9302203392cc565fc3f5b6f96d8ef8c1ca30964c51f242d16d71315802ada3ce845fee:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.