PT-2021-18253 · Envoy · Envoy

Ruilin Yang · Published 2021-05-28 · Updated 2024-03-06 · CVE-2021-29492

Positive Technologies (AI Summary)

CVSS v3.1

8.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions: Envoy versions 1.18.2 and earlier

Description: Envoy does not decode escaped slash sequences %2F and %5C in HTTP URL paths. A remote attacker may craft a path with escaped slashes, e.g. /something%2F..%2Fadmin, to bypass access control, e.g. a block on /admin. This could allow an attacker to access beyond the scope provided for by the access control policy, potentially leading to escalation of privileges when using RBAC or JWT filters with enforcement based on URL path. Users with back end servers that interpret %2F and / and %5C and `` interchangeably are impacted. The attack vector involves URL paths containing escaped slash characters delivered by untrusted clients.

Recommendations: For Envoy versions 1.18.2 and earlier, update to version 1.18.3, 1.17.3, 1.16.4, or 1.15.5, which contain a new path normalization option to decode escaped slash characters. As a temporary workaround, consider reconfiguring the back end server to not treat %2F and / and %5C and `` interchangeably, if URL path based access control is configured.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BIT-ENVOY-2021-29492

CVE-2021-29492

GHSA-4987-27FX-X6CF

RHSA-2021:1538

RHSA-2021:1540

Affected Products

Envoy

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2021-29492 · Security Note
• https://osv.dev/vulnerability/BIT-envoy-2021-29492 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-29492 · Vendor Advisory
• https://github.com/envoyproxy/envoy/security/advisories/GHSA-4987-27fx-x6cf · Note
• https://t.me/cvenotify/15688 · Telegram Post