PT-2024-31786 · Envoy · Envoy

Jforce

·

Published

2024-09-19

·

Updated

2024-10-15

·

CVE-2024-45806

CVSS v3.1

6.5

Medium

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions: Envoy versions prior to 1.28.7 Envoy versions prior to 1.29.9 Envoy versions prior to 1.30.6 Envoy versions prior to 1.31.2
Description: A security issue in Envoy allows external clients to manipulate Envoy headers, potentially leading to unauthorized access or other malicious actions within the mesh. This issue arises due to Envoy's default configuration of internal trust boundaries, which considers all RFC1918 private address ranges as internal. The default behavior for handling internal addresses in Envoy has been changed. Successful exploitation could allow attackers to bypass security controls, access sensitive data, or disrupt services within the mesh, like Istio.
Recommendations: For versions prior to 1.28.7, upgrade to version 1.28.7 or later. For versions prior to 1.29.9, upgrade to version 1.29.9 or later. For versions prior to 1.30.6, upgrade to version 1.30.6 or later. For versions prior to 1.31.2, upgrade to version 1.31.2 or later. As a temporary workaround, consider explicitly including trusted addresses or CIDR ranges into internal address config to minimize the risk of exploitation.

Exploit

Fix

IDOR

Found an issue in the description? Have something to add? Feel free to write us 👾

Weakness Enumeration

Related Identifiers

BIT-ENVOY-2024-45806
CVE-2024-45806
GHSA-FFHV-FVXQ-R6MF

Affected Products

Envoy