# Injection in path parameter of Ingress-nginx

Ingress-nginx path field allows nginx directive injection; two-stage file upload plus include yields Lua RCE and service account token theft.

- Payout: hidden
- Severity: high
- Program: Kubernetes
- Found by (vendor credit): Gafnit Amiga
- Found by: fisjkars
- Disclosed: 2026-03-07
- CVE: CVE-2021-25748
- Write-up quality: 8/10
- Original: https://hackerone.com/reports/2701701
- Library page: https://bugbountylibrary.com/r/h1%3A2701701
- Tags: area:cloud domain:cloud impact:internal-access impact:rce kind:bounty platform:hackerone sev:high tech:kubernetes tech:nginx technique:chained technique:source-review vuln:command-injection vuln:misconfiguration

**Target:** Ingress controller nginx config via Ingress path field
**Root cause:** The Ingress path parameter is not sanitized for nginx config syntax, allowing arbitrary directives to be injected into generated nginx.conf despite CVE-2021-25748 mitigations.
**Steps:**
1. Create Ingress with path containing `client_body_temp_path /tmp/nginx/f292392; client_body_in_file_only on;` to enable body-to-file upload
2. POST malicious nginx config (set_by_lua_block with io.popen) to `/f292392body/` so it lands in `/tmp/nginx/f292392/`
3. Create second Ingress with path containing `include /tmp/nginx/f292392/*;` to load uploaded config
4. Send request with `pathinjection` header containing shell command to execute via Lua and exfiltrate service account token
**How found:** Noticed path parameter is permissive and injects raw nginx directives; recognized by_lua was blocked by inspector, so used client_body_in_file_only to stage a file and include directive to load it.
**Exploitation:** Attacker with Ingress create rights uploads a Lua config via client_body_in_file_only, then includes it via a second Ingress path, achieving command execution in the controller and exfiltrating the service account token over OAST.
**Escalation:** Chained two Ingresses to bypass by_lua restrictions from CVE-2021-25748 mitigation; token theft enables cluster-level privilege escalation.
**Insight:** When a config-injection sink blocks direct code directives, look for file-write primitives (client_body_in_file_only, temp paths) plus include directives to stage and load payloads in two steps.