CVE-2023-27496 Envoy may crash when a redirect url without a state param is received in the oauth filter
Attackers can crash the Envoy proxy by sending a crafted OAuth redirect request without a state parameter, requiring the OAuth filter to be enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2023-27496?
CVE-2023-27496 is a medium-severity denial of service vulnerability in Envoyproxy Envoy, published on 4 Apr 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, the OAuth filter assumes that a `state` query param is present on any response that looks like an OAuth redirect response. Sending it a request with the URI path equivalent to the redirect path, without the `state` parameter, will lead to abnormal termination of Envoy process. Versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9 contain a patch. The issue can also be mitigated by locking down OAuth traffic, disabling the filter, or by filtering traffic before it reaches the OAuth filter (e.g. via a lua script).
Weakness: CWE-20
Which versions are affected by CVE-2023-27496?
1 open source package ship an affected version, including envoy. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
envoy Bitnami | All versions | 1.22.9, 1.23.6, 1.24.4, 1.25.3 |
Products include Envoyproxy Envoy.
How do I fix CVE-2023-27496?
Upgrade envoy to a fixed version for your release line: 1.22.9, 1.23.6, 1.24.4 or 1.25.3.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2023-27496 being exploited?
There is no known exploitation of CVE-2023-27496 in the wild and no public exploit code.
Other vulnerabilities in Envoyproxy Envoy
Sources
Also known as BIT-envoy-2023-27496, GHSA-j79q-2g66-2xv5.