CVE-2023-27488 Envoy gRPC client produces invalid protobuf when an HTTP header with non-UTF8 value is received.
Attackers can bypass ext_authz security checks or hide requests from logging by sending non-UTF8 headers when failure_mode_allow is enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2023-27488?
CVE-2023-27488 is a medium-severity vulnerability in Envoyproxy Envoy, published on 4 Apr 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, escalation of privileges is possible when `failure_mode_allow: true` is configured for `ext_authz` filter. For affected components that are used for logging and/or visibility, requests may not be logged by the receiving service.
When Envoy was configured to use ext_authz, ext_proc, tap, ratelimit filters, and grpc access log service and an http header with non-UTF-8 data was received, Envoy would generate an invalid protobuf message and send it to the configured service. The receiving service would typically generate an error when decoding the protobuf message. For ext_authz that was configured with ``failure_mode_allow: true``, the request would have been allowed in this case. For the other services, this could have resulted in other unforeseen errors such as a lack of visibility into requests.
As of versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, Envoy by default sanitizes the values sent in gRPC service calls to be valid UTF-8, replacing data that is not valid UTF-8 with a `!` character. This behavioral change can be temporarily reverted by setting runtime guard `envoy.reloadable_features.service_sanitize_non_utf8_strings` to false. As a workaround, one may set `failure_mode_allow: false` for `ext_authz`.
Weakness: CWE-20
Which versions are affected by CVE-2023-27488?
1 open source package ship an affected version, including envoy. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
envoy Bitnami | All versions | 1.22.9, 1.23.6, 1.24.4, 1.25.3 |
Products include Envoyproxy Envoy.
How do I fix CVE-2023-27488?
Upgrade envoy to a fixed version for your release line: 1.22.9, 1.23.6, 1.24.4 or 1.25.3.
Is CVE-2023-27488 being exploited?
There is no known exploitation of CVE-2023-27488 in the wild and no public exploit code.
Other vulnerabilities in Envoyproxy Envoy
Sources
Also known as BIT-envoy-2023-27488, GHSA-9g5w-hqr3-w2ph.