CVE-2023-35944 Envoy vulnerable to incorrect handling of HTTP requests and responses with mixed case schemes
Attackers can bypass security checks by using mixed-case HTTP schemes, potentially allowing unencrypted traffic to be treated as secure.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-35944?
CVE-2023-35944 is a high-severity vulnerability in Envoyproxy Envoy, published on 25 Jul 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Envoy is an open source edge and service proxy designed for cloud-native applications. Envoy allows mixed-case schemes in HTTP/2, however, some internal scheme checks are case-sensitive. Prior to versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12, this can lead to the rejection of requests with mixed-case schemes such as `htTp` or `htTps`, or the bypassing of some requests such as `https` in unencrypted connections. With a fix in versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12, Envoy will now lowercase scheme values by default, and change the internal scheme checks that were case-sensitive to be case-insensitive. There are no known workarounds for this issue.
Which versions are affected by CVE-2023-35944?
1 open source package ship an affected version, including envoy. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
envoy Bitnami | From 1.23.0 | 1.23.12, 1.24.10, 1.25.9, 1.26.4 |
Products include Envoyproxy Envoy.
How do I fix CVE-2023-35944?
Upgrade envoy to a fixed version for your release line: 1.23.12, 1.24.10, 1.25.9 or 1.26.4.
Is CVE-2023-35944 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-35944 exists.
Other vulnerabilities in Envoyproxy Envoy
Sources
Also known as BIT-envoy-2023-35944, GHSA-pvgm-7jpg-pw5g.