Vulnerability · Published Feb 9, 2024 · Assigned by GitHub_M

CVE-2024-23324Envoy ext auth can be bypassed when Proxy protocol filter sets invalid UTF-8 metadata

High 8.6

In plain English

A high-severity improper input validation in envoy from envoyproxy. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities).

Severity (CVSS 3.1)8.6High

Exploit odds (30 days)0.6%top 51.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Envoy is a high-performance edge/middle/service proxy. External authentication can be bypassed by downstream connections. Downstream clients can force invalid gRPC requests to be sent to ext_authz, circumventing ext_authz checks when failure_mode_allow is set to true. This issue has been addressed in released 1.29.1, 1.28.1, 1.27.3, and 1.26.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected products (as reported)

Vendor	Product	Versions
envoyproxy	envoy	>= 1.29.0, < 1.29.1>= 1.28.0, < 1.28.1>= 1.27.0, < 1.27.3< 1.26.7

Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

References

https://github.com/envoyproxy/envoy/security/advisories/GHSA-gq3v-vvhj-96j6 x_refsource_CONFIRM
https://github.com/envoyproxy/envoy/commit/29989f6cc8bfd8cd2ffcb7c42711eb02c7a5168a x_refsource_MISC