CVE-2019-18802 Security feature bypass in n/a
Attackers can bypass host-based routing rules in Envoy by adding whitespace to HTTP headers, potentially accessing restricted services.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-18802?
CVE-2019-18802 is a critical vulnerability in Envoyproxy Envoy, published on 13 Dec 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in Envoy 1.12.0. An untrusted remote client may send an HTTP header (such as Host) with whitespace after the header content. Envoy will treat "header-value " as a different string from "header-value" so for example with the Host header "example.com " one could bypass "example.com" matchers.
Which versions are affected by CVE-2019-18802?
It affects 1 product.
Linux distribution packages (6)
nghttp2 SUSE:Linux Enterprise Module for Basesystem 15 SP1 | All versions | 1.40.0-3.6.3 |
nghttp2 openSUSE:Leap 15.1 | All versions | 1.40.0-lp151.3.6.1 |
nghttp2-python openSUSE:Leap 15.1 | All versions | 1.40.0-lp151.3.6.1 |
nghttp2 openSUSE:Leap 15.2 | All versions | 1.40.0-lp152.2.3.1 |
nghttp2-python openSUSE:Leap 15.2 | All versions | 1.40.0-lp152.2.3.1 |
nghttp2 openSUSE:Tumbleweed | All versions | 1.64.0-1.1 |
Products include Envoyproxy Envoy.
How do I fix CVE-2019-18802?
Upgrade to a fixed version.
Is CVE-2019-18802 being exploited?
There is no known exploitation of CVE-2019-18802 in the wild and no public exploit code.
Other vulnerabilities in Envoyproxy Envoy
- CVE-2022-29226 Trivial authentication bypass in Envoy
- CVE-2019-18801 Memory corruption in n/a
- CVE-2020-35470 Information disclosure in n/a
- CVE-2024-23324 Envoy ext auth can be bypassed when Proxy protocol filter sets invalid UTF-8 metadata
- CVE-2023-35941 Envoy vulnerable to OAuth2 credentials exploit with permanent validity
Sources
Also known as GHSA-356m-vhw2-wcm4, GHSA-fx83-72pw-c56f, MGASA-2020-0147, SUSE-SU-2020:0722-1, openSUSE-SU-2020:0379-1, openSUSE-SU-2021:0341-1 and 1 more.