PT-2023-3904 · Envoy · Envoy
Erikjoh
·
Published
2023-07-25
·
Updated
2024-03-06
·
CVE-2023-35941
CVSS v2.0
9.0
High
| Vector | AV:N/AC:L/Au:N/C:C/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
Envoy versions prior to 1.27.0
Envoy versions prior to 1.26.4
Envoy versions prior to 1.25.9
Envoy versions prior to 1.24.10
Envoy versions prior to 1.23.12
Description
The issue is related to a lack of output encoding or escaping mechanism in the Envoy proxy server. This allows a remote attacker to impact the confidentiality, integrity, and availability of protected information. A malicious client can construct credentials with permanent validity in specific scenarios due to a rare issue in the OAuth2 filter's check, where the HMAC payload can always be valid.
Recommendations
For versions prior to 1.27.0, update to version 1.27.0 or later.
For versions prior to 1.26.4, update to version 1.26.4 or later.
For versions prior to 1.25.9, update to version 1.25.9 or later.
For versions prior to 1.24.10, update to version 1.24.10 or later.
For versions prior to 1.23.12, update to version 1.23.12 or later.
As a temporary workaround, avoid using wildcards or prefix domain wildcards in the host's domain configuration.
Exploit
Fix
Improper Encoding or Escaping of Output
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Envoy