Vulnerability · Published Sep 19, 2024 · Assigned by GitHub_M

CVE-2024-45808Malicious log injection via access logs in envoy

Medium 6.5

In plain English

A medium-severity security flaw in envoy from envoyproxy. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.4%top 71.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Envoy is a cloud-native high-performance edge/middle/service proxy. A vulnerability has been identified in Envoy that allows malicious attackers to inject unexpected content into access logs. This is achieved by exploiting the lack of validation for the `REQUESTED_SERVER_NAME` field for access loggers. This issue has been addressed in versions 1.31.2, 1.30.6, 1.29.9, and 1.28.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected products (as reported)

Vendor	Product	Versions
envoyproxy	envoy	>= 1.31.0, < 1.31.2>= 1.30.0, < 1.30.6>= 1.29.0, < 1.29.9< 1.28.7

Weakness: CWE-117 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

References

https://github.com/envoyproxy/envoy/security/advisories/GHSA-p222-xhp9-39rc x_refsource_CONFIRM