PT-2019-2303 · Envoy · Envoy

Harvey Tuch · Published 2019-04-14 · Updated 2022-05-24 · CVE-2019-9900

Positive Technologies (AI Summary)

CVSS v3.1

8.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Envoy versions 1.9.0 and earlier

Description The issue is related to errors in parsing HTTP headers and URL paths. This can allow a remote attacker to bypass header matching rules and access control, potentially gaining access to unauthorized resources. The vulnerability can be exploited by crafting header values containing embedded NUL characters or by using relative paths to bypass access control.

Recommendations For Envoy versions 1.9.0 and earlier, consider disabling the HTTP/1.x parsing functionality until a patch is available. Restrict access to sensitive resources by implementing additional access control mechanisms. Avoid using relative paths in HTTP URL requests to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Special Elements Injection

Weakness Enumeration

CWE-706

CWE-20

CWE-74

Related Identifiers

BDU:2019-02074

CVE-2019-9900

GHSA-2WMF-P7F8-W42H

GHSA-X74R-F4MW-C32H

RHSA-2019:0741

Affected Products

Envoy

References · 19

• 🔥 https://github.com/envoyproxy/envoy/blob/main/security/postmortems/cve-2019-9900.md · Exploit
• 🔥 https://github.com/envoyproxy/envoy/security/advisories/GHSA-x74r-f4mw-c32h · Exploit
• 🔥 https://github.com/envoyproxy/envoy/issues/6434 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-9901 · Security Note
• https://access.redhat.com/errata/RHSA-2019:0741 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-9900 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-02074 · Security Note
• https://osv.dev/vulnerability/GHSA-2wmf-p7f8-w42h · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-9900 · Security Note
• https://envoyproxy.io/docs/envoy/v1.9.1/intro/version_history · Vendor Advisory
• https://github.com/envoyproxy/envoy · Note
• https://github.com/envoyproxy/envoy/issues/6435 · Note
• https://github.com/envoyproxy/envoy/security/advisories/GHSA-xcx5-93pw-jw2w · Note
• https://github.com/envoyproxy/envoy/commit/e668e669677e52a00d99652b5a260d1cedafdfa8 · Note
• https://groups.google.com/forum/#%21topic/envoy-announce/VoHfnDqZiAM · Note