GitHub Advisory DatabaseGHSA-2WMF-P7F8-W42HEnvoyProxy Envoy Missing HTTP URL path normalization
10 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.004 Low
EPSS
Percentile
71.7%
Envoy 1.9.0 and before does not normalize HTTP URL paths. A remote attacker may craft a relative path, e.g., something/../admin, to bypass access control, e.g., a block on /admin. A backend server could then interpret the non-normalized path and provide an attacker access beyond the scope provided for by the access control policy.
| CPE | Name | Operator | Version |
|---|---|---|---|
| github.com/envoyproxy/envoy | le | 1.9.0 |
References
github.com/advisories/GHSA-2wmf-p7f8-w42h
github.com/envoyproxy/envoy/blob/main/security/postmortems/cve-2019-9900.md
github.com/envoyproxy/envoy/commit/e668e669677e52a00d99652b5a260d1cedafdfa8
github.com/envoyproxy/envoy/issues/6435
github.com/envoyproxy/envoy/security/advisories/GHSA-xcx5-93pw-jw2w
groups.google.com/forum/#!topic/envoy-announce/VoHfnDqZiAM
nvd.nist.gov/vuln/detail/CVE-2019-9901
www.envoyproxy.io/docs/envoy/v1.9.1/intro/version_history
Related
10 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.004 Low
EPSS
Percentile
71.7%