PT-2020-20319 · Istio · Istio

Eric Zhang + 1 · Published 2020-02-14 · Updated 2020-02-19 · CVE-2020-8843

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Istio versions 1.3 through 1.3.6

Description An issue allows bypassing a specifically configured Mixer policy under certain circumstances. The Istio-proxy accepts the x-istio-attributes header at ingress, which can affect policy decisions when Mixer policy selectively applies to a source equal to ingress. Exploitation requires encoding a source.uid in this header. This feature is disabled by default in Istio 1.3 and 1.4.

Recommendations For Istio versions 1.3 through 1.3.6, consider disabling the feature that accepts the x-istio-attributes header at ingress to prevent policy bypass until a patch is available.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2020-8843

Affected Products

Istio

References · 5

• https://github.com/istio/istio/commits/master · Patch
• https://istio.io/news/security/istio-security-2020-002 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-8843 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-8843 · Security Note
• https://istio.io/news/security · Vendor Advisory