search

kubernetes / ingress-nginx

Ingress NGINX Controller for Kubernetes
https://kubernetes.github.io/ingress-nginx/
Apache License 2.0
17.43k stars 8.24k forks source link

CORS configuration from annotation fails penetration test #12230

Open stex79 opened 2 days ago

stex79 commented 2 days ago

What happened: When adding the CORS annotation for thee allowed origin:

nginx.ingress.kubernetes.io/cors-allow-headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization,X-Api-Key,Powered-By,Content-Encoding,Auto-Refresh
nginx.ingress.kubernetes.io/cors-allow-origin: https://mydomain.com
nginx.ingress.kubernetes.io/enable-cors: 'true'

the generated configuration looks like this:

if ($http_origin ~* ((https://mydomain\.com))$ ) { set $cors 'true'; }

This configuration limits the setting of $cors to true only for requests with origin matching https://mydomain.com and it does not enforce CORS setting for all the other requests. For this reason penetration tests for the CORS settings fails because don't satisfy basic requirements for CORS enforcement (see https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/11-Client-side_Testing/07-Testing_Cross_Origin_Resource_Sharing)

What you expected to happen: You would expect that when enabled by the annotation the CORS settings are applied according to standards, and specifically the if statement before mentioned should instead be removed forcing the allowed origin to be set as specified by the annotation.

The template engine should be modified to rectify this vulnerability.

NGINX Ingress controller version (exec into the pod and run nginx-ingress-controller --version.): registry.k8s.io/ingress-nginx/controller:v1.9.4@sha256:5b161f051d017e55d358435f295f5e9a297e66158f136321d9b04520ec6c48a3

Kubernetes version (use kubectl version): 1.27.10

Environment:

How to reproduce this issue: Just set the following annotations to an ingress and check the resulting nginx.conf generated:

nginx.ingress.kubernetes.io/cors-allow-origin: https://mydomain.com
nginx.ingress.kubernetes.io/enable-cors: 'true

Anything else we need to know: OWASP documentation: https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/11-Client-side_Testing/07-Testing_Cross_Origin_Resource_Sharing CORS configuration reference example: https://enable-cors.org/server_nginx.html

k8s-ci-robot commented 2 days ago

This issue is currently awaiting triage.

If Ingress contributors determines this is a relevant issue, they will accept it by applying the triage/accepted label and provide further guidance.

The triage/accepted label can be added by org members by writing /triage accepted in a comment.

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md). If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes-sigs/prow](https://github.com/kubernetes-sigs/prow/issues/new?title=Prow%20issue:) repository.
longwuyuan commented 1 day ago

/remove-kind bug /kind support /help

We need a CORS expert to comment here.

There was some work done to harden the CORS config. If you can not set more than the allowed origin, its bad for you but good for the project, as the risk is less when compared to allowing whatever origins you want to be set..

k8s-ci-robot commented 1 day ago

@longwuyuan: This request has been marked as needing help from a contributor.

Guidelines

Please ensure that the issue body includes answers to the following questions:

For more details on the requirements of such an issue, please see here and ensure that they are met.

If this request no longer meets these requirements, the label can be removed by commenting with the /remove-help command.

In response to [this](https://github.com/kubernetes/ingress-nginx/issues/12230): >/remove-kind bug >/kind support >/help > >We need a CORS expert to comment here. > >There was some work done to harden the CORS config. If you can not set more than the allowed origin, its bad for you for good for the project as risk is less when compared to allowing whatever origins you want to be set.. Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md). If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes-sigs/prow](https://github.com/kubernetes-sigs/prow/issues/new?title=Prow%20issue:) repository.