PT-2024-19809 · Envoy · Envoy
Rory Mcnamara
·
Published
2024-06-04
·
Updated
2024-07-11
·
CVE-2024-23326
CVSS v3.1
5.9
Medium
| Vector | AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Envoy (affected versions not specified)
Description
A theoretical request smuggling issue exists in Envoy, a cloud-native, open source edge and service proxy. This occurs when a server is tricked into adding an upgrade header into a response. According to RFC 7230, a server sends a 101 response when switching protocols, but Envoy incorrectly accepts a 200 response from a server when requesting a protocol upgrade. This allows for the possibility of request smuggling through Envoy if the server can be tricked into adding the upgrade header to the response. The issue can be exploited by convincing Envoy that a TCP connection was successfully upgraded to WebSocket, which can be done by setting the
upgrade and connection parameters to websockets and upgrade, respectively. After this, all requests sent to endpoints restricted by AuthorizationPolicy will pass successfully.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
HTTP Request/Response Smuggling
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Envoy