Envoy vulnerable to OAuth2 credentials exploit with permanent validity
CVE-2023-35941

8.6HIGH

Key Information:

Vendor

Envoyproxy

Status
Envoy
Vendor
CVE Published:
25 July 2023

What is CVE-2023-35941?

A vulnerability in the Envoy edge and service proxy allows a malicious client to exploit specific scenarios that permit the construction of credentials with permanent validity. This issue arises from rare conditions where the HMAC payload can bypass checks made by the OAuth2 filter, potentially allowing unauthorized access. The vulnerability can be mitigated by avoiding the use of wildcards or prefix domain wildcards in the host's domain configuration. Users are strongly advised to upgrade to the latest versions of Envoy to safeguard their cloud-native applications.

Affected Version(s)

envoy >= 1.26.0, < 1.26.4 < 1.26.0, 1.26.4

envoy >= 1.25.0, < 1.25.9 < 1.25.0, 1.25.9

envoy >= 1.24.0, < 1.24.10 < 1.24.0, 1.24.10

References

https://github.com/envoyproxy/envoy/security/advisories/G...
x_refsource_CONFIRM

CVSS V3.1

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.