# Config directive injection in generated proxy config

User fields templated into generated nginx/proxy config; check newline, brace, and directive breakout

_Area: Cloud and container security. Seen in 2 disclosed reports; 2 confirmed bounties: $2,500 and $2,500; latest 2023-10-26. Updated 2026-10-23._

## How it works
A controller takes a user-supplied field (an Ingress path, an annotation) and writes it into a generated config file (nginx.conf) as if it were a plain literal. The assumption that breaks: the field is treated as data, but the config language has its own syntax. Newlines and braces in the field close the intended block and open new directives, so the attacker controls the generated config, not just a value inside it. Once directives are injectable, primitives like `alias`/`root` (read files), `access_log` with a custom `log_format` (write files), and `include` (load attacker content) turn config control into file access or code execution in the controller pod [E1](https://bugbountylibrary.com/r/h1%3A1620702.md)[E2](https://bugbountylibrary.com/r/h1%3A1382919.md).

## Where it shows up
- Fields interpolated into generated config: Ingress `spec.rules.http.paths.path`, annotations, hostnames, upstream names [E1](https://bugbountylibrary.com/r/h1%3A1620702.md)[E2](https://bugbountylibrary.com/r/h1%3A1382919.md).
- Config generators that concatenate strings rather than escaping or validating against a strict grammar.
- Snippet-accepting annotations (`server-snippet`, Lua blocks) that allow arbitrary directives by design [E3](https://bugbountylibrary.com/r/h1%3A1249583.md).
- Controller pods mounting a serviceaccount token with broad RBAC (e.g. list secrets cluster-wide) [E2](https://bugbountylibrary.com/r/h1%3A1382919.md)[E3](https://bugbountylibrary.com/r/h1%3A1249583.md).

## How to review
The invariant: every user-controlled value placed in generated config must be constrained to a grammar that cannot express block or directive syntax (no newlines, braces, semicolons, or directive keywords), or must be escaped by the generator. Check the generator code for the exact field, confirm validation is allowlist-based, and confirm the controller's own credentials are least-privilege. If snippets are permitted, treat the controller SA token as reachable by any principal allowed to create that object [E3](https://bugbountylibrary.com/r/h1%3A1249583.md).

## Variants seen
- Newline/brace breakout injecting `log_format` + `access_log` for arbitrary file write, then `include` for Lua RCE [E1](https://bugbountylibrary.com/r/h1%3A1620702.md).
- Brace block plus `alias` directive mapping a URL to the SA token mount path, exposing the token [E2](https://bugbountylibrary.com/r/h1%3A1382919.md).
- Legitimate snippet annotations plus over-privileged SA token enabling cluster-wide secret listing [E3](https://bugbountylibrary.com/r/h1%3A1249583.md).

## Impact and severity
Ranged from controller-pod RCE [E1](https://bugbountylibrary.com/r/h1%3A1620702.md) to serviceaccount token theft and cluster-wide secret exfiltration [E2](https://bugbountylibrary.com/r/h1%3A1382919.md)[E3](https://bugbountylibrary.com/r/h1%3A1249583.md). Severity is raised by over-privileged controller RBAC and by any low-privilege principal (ingress-create) being enough to trigger it.

## Why fixes fail
Escaping only some characters, or validating paths loosely, leaves brace/newline breakout; snippet features remain an intentional injection surface unless RBAC is tightened [E3](https://bugbountylibrary.com/r/h1%3A1249583.md).

## Evidence
- E1: https://bugbountylibrary.com/r/h1%3A1620702.md
- E2: https://bugbountylibrary.com/r/h1%3A1382919.md
- E3: https://bugbountylibrary.com/r/h1%3A1249583.md