This vulnerability impacts kubernetes setups using NGINX as the ingress controller via ingress-nginx. At first I wanted to blame this one on block-listing when they should have used an allow-list, but its not quite that, but it is basically just a missed edge-case that allows for code execution.

There is a bit of a high privilege ask as the attacker must be able to create or update ingress objects.

Basically in creating a new ingress the system supports adding an annotation that includes a configuration snippet that’ll be used in the nginx config for the rule. Obviously there are risks with what you can do with that so ingress-nginx already would patch out certain directives like root and alias to prevent reading into unexpected directories. The patch just literally removes the directives from nginx all together.

They did not remove the content_by_lua_block however, which meant someone who can provide one of those configuration snippets could create a location entry that was served by lua provided by the configuration snippet itself.