CVE-2024-23324 Envoy ext auth can be bypassed when Proxy protocol filter sets invalid UTF-8 metadata

2024-02-0922:48:26

CWE-20

GitHub_M

github.com

envoy

ext_authz

bypass vulnerability

CVSS3

8.6

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

AI Score

6.9

Confidence

Low

SSVC

Exploitation

none

Automatable

yes

Technical Impact

partial

JSON

Envoy is a high-performance edge/middle/service proxy. External authentication can be bypassed by downstream connections. Downstream clients can force invalid gRPC requests to be sent to ext_authz, circumventing ext_authz checks when failure_mode_allow is set to true. This issue has been addressed in released 1.29.1, 1.28.1, 1.27.3, and 1.26.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CNA Affected

[
  {
    "vendor": "envoyproxy",
    "product": "envoy",
    "versions": [
      {
        "status": "affected",
        "version": ">= 1.29.0, < 1.29.1"
      },
      {
        "status": "affected",
        "version": ">= 1.28.0, < 1.28.1"
      },
      {
        "status": "affected",
        "version": ">= 1.27.0, < 1.27.3"
      },
      {
        "status": "affected",
        "version": "< 1.26.7"
      }
    ]
  }
]

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*"
    ],
    "vendor": "envoyproxy",
    "product": "envoy",
    "versions": [
      {
        "status": "affected",
        "version": "1.29.0",
        "lessThan": "1.29.1",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "1.28.0",
        "lessThan": "1.28.1",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "1.27.0",
        "lessThan": "1.27.3",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "0",
        "lessThan": "1.26.7",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  }
]