The Route OpenShift resource allows to define routes to make pods reachable at a subdomain through HAProxy. These Routes are managed by the openshift-ingress/router-default pods. One of the features of Routes is their ability to match a URI's path and replace it, this is expressed in the Route by the spec.path and metadata.annotations"[haproxy.router.openshift.io/rewrite-target YAML stanzas in a Route document which are in turn (after various checks and sanitization) used as parameters to a HAProxy configuration template. This configuration template is expressed in plaintext, thus the templating engine cannot automatically escape values to enforce the document structure, escaping has to be performed on the values before the template's evaluation.

By default the Developer role can create Routes to expose their services.

It was found that the checks performed on the Routes spec.path was insufficient and could allow a controlled injection of the HAProxy configuration.