Vulnerability · Published Apr 4, 2023 · Assigned by GitHub_M

CVE-2023-27493Envoy doesn't escape HTTP header values

High 8.1

In plain English

A high-severity improper input validation in envoy from envoyproxy. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)0.5%top 56.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, Envoy does not sanitize or escape request properties when generating request headers. This can lead to characters that are illegal in header values to be sent to the upstream service. In the worst case, it can cause upstream service to interpret the original request as two pipelined requests, possibly bypassing the intent of Envoy’s security policy. Versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9 contain a patch. As a workaround, disable adding request headers based on the downstream request properties, such as downstream certificate properties.

Affected products (as reported)

Vendor	Product	Versions
envoyproxy	envoy	>= 1.25.0, < 1.25.3>= 1.24.0, < 1.24.4>= 1.23.0, < 1.23.6< 1.22.9

Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

References

https://github.com/envoyproxy/envoy/security/advisories/GHSA-w5w5-487h-qv8q x_refsource_CONFIRM