Configuration Injection RCE in ingress-nginx Ingress path handling

This repository is a self-contained Docker lab and exploit kit for a simulated CVE-2026-3288 NGINX Ingress Controller configuration-injection issue. It is not tied to a common exploit framework. The repo contains 15 files: documentation (README.md, INSTALL.md, TESTING.md), Docker orchestration (docker-compose.yml), a vulnerable NGINX container and Flask backend, an automated Python exploit, a shell-based manual test harness, payload examples, a log-monitoring script, and a cleanup script. Core exploit logic is in exploits/exploit.py. The Python script uses requests.Session to target a base URL, first checking /health, then attempting six scenarios: response hijacking, Authorization header theft, phishing redirect injection, internal IP disclosure, cookie theft, and User-Agent reflection. Payloads are path strings containing an injected double quote followed by NGINX directives such as return 200 or return 302. Success criteria are simple response-content/status checks, making this an operational but basic exploit rather than a weaponized framework module. The vulnerable environment is implemented in docker/nginx/vulnerable-config.conf and docker/backend/app.py. NGINX listens on port 80 and is published to host port 9090. It proxies to an upstream named backend at backend:5000. The config intentionally simulates unsafe path handling around /api and /vuln, includes a /login location that reflects Authorization data via headers and proxying, an /admin path that can disclose an internal IP string, a /backend proxy path, and /health. The Flask backend exposes /, /health, /api/users, /api/data, /login, /admin, and /secret, with several endpoints returning sensitive-looking demo data and reflected headers. Fingerprintable infrastructure includes localhost-based lab URLs, backend:5000 as the upstream service, host ports 9090/9443, NGINX config/log file paths, and attacker redirect domains such as evil.com. The repository also includes detection/monitor-logs.sh, which tails docker-compose nginx logs and greps for suspicious injected directives like return, rewrite, set, add_header, and proxy_pass followed by quotes. Overall, the repository’s purpose is training and demonstration of web-based configuration injection leading to response manipulation and information disclosure, not stealthy post-exploitation or real RCE delivery.