PT-2024-31786 · Envoy · Envoy
Jforce
·
Published
2024-09-19
·
Updated
2024-10-15
·
CVE-2024-45806
CVSS v3.1
6.5
Medium
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions:
Envoy versions prior to 1.28.7
Envoy versions prior to 1.29.9
Envoy versions prior to 1.30.6
Envoy versions prior to 1.31.2
Description:
A security issue in Envoy allows external clients to manipulate Envoy headers, potentially leading to unauthorized access or other malicious actions within the mesh. This issue arises due to Envoy's default configuration of internal trust boundaries, which considers all RFC1918 private address ranges as internal. The default behavior for handling internal addresses in Envoy has been changed. Successful exploitation could allow attackers to bypass security controls, access sensitive data, or disrupt services within the mesh, like Istio.
Recommendations:
For versions prior to 1.28.7, upgrade to version 1.28.7 or later.
For versions prior to 1.29.9, upgrade to version 1.29.9 or later.
For versions prior to 1.30.6, upgrade to version 1.30.6 or later.
For versions prior to 1.31.2, upgrade to version 1.31.2 or later.
As a temporary workaround, consider explicitly including trusted addresses or CIDR ranges into
internal address config to minimize the risk of exploitation.Exploit
Fix
IDOR
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Envoy