# Authenticated kubernetes principal with restricted permissions can retrieve ingress-nginx serviceaccount token and secrets across all namespaces

ingress-nginx server-snippet Lua reads the controller's mounted serviceaccount token, which can list secrets cluster-wide, enabling full secret exfiltration and cluster-admin escalation.

- Payout: hidden
- Severity: high
- Program: Kubernetes
- Found by: libio
- Disclosed: 2021-12-04
- Write-up quality: 8/10
- Original: https://hackerone.com/reports/1249583
- Library page: https://bugbountylibrary.com/r/h1%3A1249583
- Tags: area:cloud domain:cloud impact:data-leak impact:privesc kind:bounty platform:hackerone sev:high tech:kubernetes tech:nginx technique:chained vuln:misconfiguration vuln:privilege-escalation vuln:secrets-leak

**Target:** Kubernetes ingress-nginx controller (nginx config annotations)
**Root cause:** ingress-nginx permits arbitrary nginx/lua snippets via server-snippet annotations, and the controller's serviceaccount is over-privileged (list secrets cluster-wide).
**Steps:**
1. Create a Service of type ExternalName pointing to kubernetes.default to proxy kube-apiserver.
2. Create an Ingress with `nginx.ingress.kubernetes.io/server-snippet` containing `set_by_lua` that reads `/run/secrets/kubernetes.io/serviceaccount/token` into a variable and a `location = /token` returning it.
3. Request `https://$INGRESS_HOST/token` (or set Host header manually) to retrieve the ingress-nginx SA token.
4. Use the token against the proxied kube-apiserver to `list secrets` across all namespaces.
5. Extract serviceaccount tokens from secrets and check for cluster-admin; build kubeconfig with a privileged token.
**How found:** Observed that ingress-nginx supports arbitrary lua snippets in server blocks and that the controller pod mounts a serviceaccount token with broad RBAC; combined with ExternalName service to reach kube-apiserver.
**Exploitation:** Attacker with create ingress+service permissions deploys a malicious ingress whose Lua snippet exfiltrates the controller SA token, plus an ExternalName service exposing kube-apiserver; uses the token to dump all secrets and harvest cluster-admin SA tokens.
**Escalation:** Chains token theft to cluster-wide secret listing, then to cluster-admin by finding a privileged serviceaccount token (e.g. flux, flux-helm-operator).
**Insight:** When a controller accepts user-supplied config that can execute code (lua/nginx snippets), the controller's own mounted SA token becomes an exfil target; check RBAC of the component's serviceaccount, not just the app logic.