PT-2022-19477 · Envoy · Envoy

Weiqiu Wen · Published 2022-06-09 · Updated 2024-03-06 · CVE-2022-29226

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Envoy versions prior to 1.22.1

Description The OAuth filter implementation in Envoy does not include a mechanism for validating access tokens. By design, when the HMAC signed cookie is missing, a full authentication flow should be triggered. However, the current implementation assumes that access tokens are always validated, thus allowing access in the presence of any access token attached to the request.

Recommendations For versions prior to 1.22.1, upgrade to version 1.22.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the OAuth filter implementation until a patch is available.

Exploit

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

BIT-ENVOY-2022-29226

CVE-2022-29226

GHSA-H45C-2F94-PRXH

RHSA-2022:5004

Affected Products

Envoy

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/29xxx/CVE-2022-29226.json · Exploit
• https://github.com/envoyproxy/envoy/commit/7ffda4e809dec74449ebc330cebb9d2f4ab61360 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-29226 · Security Note
• https://osv.dev/vulnerability/BIT-envoy-2022-29226 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-29226 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2022-9586.html · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2022-9588.html · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2022-9587.html · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2022-9589.html · Vendor Advisory
• https://github.com/envoyproxy/envoy/security/advisories/GHSA-h45c-2f94-prxh · Note
• https://t.me/cibsecurity/44145 · Telegram Post