Authentication Bypass in Istio Across Multiple Versions

CVE-2020-8595

What is CVE-2020-8595?

Certain versions of Istio, including 1.2.10, 1.3 through 1.3.7, and 1.4 through 1.4.3, exhibit a vulnerability allowing attackers to bypass authentication mechanisms. Specifically, the authentication policies relying on exact-path matching can be circumvented when a user appends a ? or # character to a URI. This enables unauthorized access to HTTP paths that should otherwise be secured, as these characters allow the request to bypass the validation checks for valid JWT tokens. This vulnerability poses a significant risk, as it undermines the intended access control measures in place.

References