CVE-2021-32779
published 2021-08-24CVE-2021-32779: Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions envoy incorrectly handled…
PriorityP347high8.3CVSS 3.1
AVNACLPRNUINSCCLILAL
EPSS
0.95%
56.7th percentile
Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions envoy incorrectly handled a URI '#fragment' element as part of the path element. Envoy is configured with an RBAC filter for authorization or similar mechanism with an explicit case of a final "/admin" path element, or is using a negative assertion with final path element of "/admin". The client sends request to "/app1/admin#foo". In Envoy prior to 1.18.0, or 1.18.0+ configured with path_normalization=false. Envoy treats fragment as a suffix of the query string when present, or as a suffix of the path when query string is absent, so it evaluates the final path element as "/admin#foo" and mismatches with the configured "/admin" path element. In Envoy 1.18.0+ configured with path_normalization=true. Envoy transforms this to /app1/admin%23foo and mismatches with the configured /admin prefix. The resulting URI is sent to the next server-agent with the offending "#foo" fragment which violates RFC3986 or with the nonsensical "%23foo" text appended. A specifically constructed request with URI containing '#fragment' element delivered by an untrusted client in the presence of path based request authorization resulting in escalation of Privileges when path based request authorization extensions. Envoy versions 1.19.1, 1.18.4, 1.17.4, 1.16.5 contain fixes that removes fragment from URI path in incoming requests.
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| envoyproxy | envoy | < 1.16.5 | 1.16.5 |
| envoyproxy | envoy | — | — |
| envoyproxy | envoy | — | — |
| envoyproxy | envoy | — | — |
| envoyproxy | envoy | — | — |
| envoyproxy | envoy | — | — |
| envoyproxy | envoy | >= 1.16.0 < 1.16.5 | 1.16.5 |
| envoyproxy | envoy | >= 1.17.0 < 1.17.4 | 1.17.4 |
| envoyproxy | envoy | >= 1.18.0 < 1.18.4 | 1.18.4 |
| github.com | pomerium_pomerium | >= 0.11.0 < 0.14.8 | 0.14.8 |
| github.com | pomerium_pomerium | >= 0.15.0 < 0.15.1 | 0.15.1 |
| pomerium | pomerium | — | — |
| pomerium | pomerium | >= 0.11.0 < 0.14.8 | 0.14.8 |
CVSS provenance
nvdv3.18.3HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
ghsa8.3HIGH
osv8.3HIGH
vendor_redhat8.6HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Incorrect Authorization with specially crafted requests
osv·2021-09-10·CVSS 8.3
CVE-2021-39206 [HIGH] Incorrect Authorization with specially crafted requests
Incorrect Authorization with specially crafted requests
Envoy, which Pomerium is based on, contains two authorization related vulnerabilities:
- [CVE-2021-32777](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32779): incorrectly transform a URL containing a `#fragment` element, causing a mismatch in path-prefix based authorization decisions.
- [CVE-2021-32779](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32777): incorrectly handle duplicate headers, dropping all but the last. This may lead to incorrect routing or authorization policy decisions.
### Impact
With specially crafted requests, incorrect authorization or routing decisions may be made by Pomerium.
### Patches
Pomerium v0.14.8 and v0.15.1 contain an upgraded envoy binary with these vulnerabilities patched.
GHSA
Incorrect Authorization with specially crafted requests
ghsa·2021-09-10·CVSS 8.3
CVE-2021-39206 [HIGH] CWE-863 Incorrect Authorization with specially crafted requests
Incorrect Authorization with specially crafted requests
Envoy, which Pomerium is based on, contains two authorization related vulnerabilities:
- [CVE-2021-32777](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32779): incorrectly transform a URL containing a `#fragment` element, causing a mismatch in path-prefix based authorization decisions.
- [CVE-2021-32779](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32777): incorrectly handle duplicate headers, dropping all but the last. This may lead to incorrect routing or authorization policy decisions.
### Impact
With specially crafted requests, incorrect authorization or routing decisions may be made by Pomerium.
### Patches
Pomerium v0.14.8 and v0.15.1 contain an upgraded envoy binary with these vulnerabilities patched.
Red Hat
envoyproxy/envoy: HTTP request with a URL fragment in the URI can bypass authorization policies
vendor_redhat·2021-08-24·CVSS 8.6
CVE-2021-32779 [HIGH] CWE-863 envoyproxy/envoy: HTTP request with a URL fragment in the URI can bypass authorization policies
envoyproxy/envoy: HTTP request with a URL fragment in the URI can bypass authorization policies
Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions envoy incorrectly handled a URI '#fragment' element as part of the path element. Envoy is configured with an RBAC filter for authorization or similar mechanism with an explicit case of a final "/admin" path element, or is using a negative assertion with final path element of "/admin". The client sends request to "/app1/admin#foo". In Envoy prior to 1.18.0, or 1.18.0+ configured with path_normalization=false. Envoy treats fragment as a suffix of the query string when present, or as a suffix of the path when query string is absent, so it evaluates the final path el
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/envoyproxy/envoy/security/advisories/GHSA-r222-74fw-jqr9https://www.envoyproxy.io/docs/envoy/v1.19.0/version_history/version_historyhttps://github.com/envoyproxy/envoy/security/advisories/GHSA-r222-74fw-jqr9https://www.envoyproxy.io/docs/envoy/v1.19.0/version_history/version_history
2021-08-24
Published