CVE-2022-29226 Trivial authentication bypass in Envoy
Attackers can bypass authentication in Envoy's OAuth filter by attaching any access token, allowing unauthorized access to protected resources.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-29226?
CVE-2022-29226 is a critical authentication bypass vulnerability in Envoyproxy Envoy, published on 9 Jun 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Envoy is a cloud-native high-performance proxy. In versions prior to 1.22.1 the OAuth filter implementation does not include a mechanism for validating access tokens, so by design when the HMAC signed cookie is missing a full authentication flow should be triggered. However, the current implementation assumes that access tokens are always validated thus allowing access in the presence of any access token attached to the request. Users are advised to upgrade. There is no known workaround for this issue.
Weakness: CWE-306
Which versions are affected by CVE-2022-29226?
1 open source package ship an affected version, including envoy. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
envoy Bitnami | All versions | 1.22.1 |
Products include Envoyproxy Envoy.
How do I fix CVE-2022-29226?
Upgrade envoy to 1.22.1 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2022-29226 being exploited?
There is no known exploitation of CVE-2022-29226 in the wild and no public exploit code.
Other vulnerabilities in Envoyproxy Envoy
- CVE-2019-18801 Memory corruption in n/a
- CVE-2019-18802 Security feature bypass in n/a
- CVE-2020-35470 Information disclosure in n/a
- CVE-2024-23324 Envoy ext auth can be bypassed when Proxy protocol filter sets invalid UTF-8 metadata
- CVE-2023-35941 Envoy vulnerable to OAuth2 credentials exploit with permanent validity
Sources
Also known as BIT-envoy-2022-29226, GHSA-h45c-2f94-prxh.