PT-2025-9996 · Unknown · Envoy Gateway+1

Denniskniep · Published 2025-03-06 · Updated 2025-09-09 · CVE-2025-25294

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Envoy Gateway versions prior to 1.2.7 Envoy Gateway versions prior to 1.3.1

Description The issue concerns a default Envoy Proxy access log configuration that is vulnerable to log injection attacks. An attacker can use a specially crafted user-agent to perform JSON injection, allowing them to add and overwrite fields in the access log.

Recommendations For versions prior to 1.2.7, update to version 1.2.7 to resolve the issue. For versions prior to 1.3.1, update to version 1.3.1 to resolve the issue. As a temporary workaround, consider modifying the EnvoyProxy.spec.telemetry.accessLog setting to use a JSON formatter instead of the old text-based default format.

Exploit

Fix

Weakness Enumeration

CWE-117

Related Identifiers

BIT-ENVOY-GATEWAY-2025-25294

CVE-2025-25294

GHSA-MF24-CHXH-HMVJ

GO-2025-3504

OPENSUSE-SU-2025:14889-1

Affected Products

Envoy Gateway

Envoyproxy

References · 48

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/25xxx/CVE-2025-25294.json · Exploit
• https://github.com/envoyproxy/gateway/commit/8f48f5199cf1bbb9a8ac0695c5171bfef6c9198a · Patch
• https://osv.dev/vulnerability/CVE-2025-25294 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-envoy-gateway-2025-25294 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-3504 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mf24-chxh-hmvj · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:14889-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-25294 · Security Note
• https://github.com/envoyproxy/gateway · Note
• https://github.com/envoyproxy/gateway/security/advisories/GHSA-mf24-chxh-hmvj · Note
• https://github.com/envoyproxy/gateway/releases/tag/v1.2.7 · Note
• https://github.com/envoyproxy/gateway/commit/358bed50dcb7b32f39a2edb252fb1399c7fc65dc · Note
• https://github.com/envoyproxy/gateway/commit/041d474a70d5921e5d65e6e14ea60e14dac70b01 · Note
• https://github.com/envoyproxy/gateway/releases/tag/v1.3.1 · Note
• https://suse.com/security/cve/CVE-2025-24526 · Note